CVE-2026-48766 in Typebot
Summary
by MITRE • 08/11/2026
TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to exfiltrate stored OpenAI-compatible API keys by invoking the OpenAI model-listing helper with an attacker-controlled `baseUrl`. The vulnerable path decrypts the selected workspace credential, creates an OpenAI client with the secret in both `apiKey` and the explicit `api-key` header, and then sends the outbound request to the caller-supplied URL. Because the permission check accepts any readable workspace member and `listCredentials` reveals credential identifiers to guests, a guest can force the server to deliver the workspace secret to attacker infrastructure. Version 3.17.0 patches the issue.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
The TypeBot vulnerability represents a critical security flaw in chatbot development platforms where insufficient access controls and improper credential handling create an avenue for privilege escalation and data exfiltration. This vulnerability affects versions prior to 3170 and stems from a fundamental design weakness in how the platform manages workspace credentials and API key validation. The flaw allows low-privilege guest members to exploit a path that was intended for legitimate credential listing but becomes a vector for unauthorized data extraction through manipulation of the base URL parameter.
The technical implementation of this vulnerability exploits the OpenAI-compatible API integration within TypeBot's architecture, specifically targeting the credential decryption and client creation process. When a guest user invokes the model-listing helper function with a maliciously controlled baseUrl parameter, the system decrypts workspace credentials without proper authorization verification. The resulting OpenAI client instance is configured with the secret API key both in the apiKey parameter and as an explicit api-key header, creating redundant exposure points that amplify the security risk. This configuration pattern violates basic security principles by exposing sensitive authentication tokens through multiple channels simultaneously.
The operational impact of this vulnerability extends beyond simple credential theft, as it enables attackers to establish persistent access to workspace resources and potentially compromise downstream systems that depend on these API keys. The permission model flaw allows any readable workspace member to access the listCredentials endpoint, which reveals credential identifiers to guests who should otherwise have restricted access. This creates a scenario where attackers can systematically enumerate available credentials and then use them to make authenticated requests to external infrastructure controlled by the attacker. The vulnerability essentially transforms guest-level access into a foothold for more extensive compromise.
The mitigation implemented in TypeBot version 3170 addresses this issue through enhanced access controls and proper credential handling procedures that prevent unauthorized users from triggering the vulnerable code path. This fix aligns with security best practices outlined in the CWE (Common Weakness Enumeration) catalog, particularly addressing CWE-284 (Improper Access Control) and CWE-522 (Insufficiently Protected Credentials). The remediation likely includes stricter permission validation before credential decryption, proper input sanitization of base URL parameters, and implementation of secure credential storage mechanisms that prevent exposure through redundant authentication headers. Organizations using TypeBot should immediately upgrade to version 3170 or later to protect against this vulnerability and ensure compliance with industry standards such as those recommended by the ATT&CK framework for preventing credential access and privilege escalation attacks.