baptisteArno typebot.io up to 3.15.x getLinkedTypebots API Endpoint Array.filter authorization

Summaryinfo

A vulnerability classified as problematic was found in baptisteArno typebot.io up to 3.15.x. Impacted is the function Array.filter of the component getLinkedTypebots API Endpoint. Executing a manipulation can lead to authorization. This vulnerability is registered as CVE-2026-39966. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in baptisteArno typebot.io up to 3.15.x and classified as problematic. This vulnerability affects the function Array.filter of the component getLinkedTypebots API Endpoint. The manipulation with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-863. The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. As an impact it is known to affect confidentiality. CVE summarizes:

TypeBot is a chatbot builder tool. In versions 3.15.2, the getLinkedTypebots API endpoint returns full bot definitions to any authenticated user who references a target bot ID in a Typebot Link block, regardless of workspace ownership, leading to IDOR. The authorization check uses Array.filter() with an async callback — since filter() is synchronous, the callback always returns a truthy Promise, so the access control predicate is never actually evaluated. Any authenticated Typebot user can read the full definition of any other workspace's private bots, including: all conversation blocks and logic flow, variable values embedded in the bot (credentials, API keys, PII), webhook URLs and integration configurations. This issue has been fixed in version 3.16.0.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-39966 since 04/08/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available.

Upgrading to version 3.16.0 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch b9530a089b43bfa6e79e3ff9cbfab921ce832f45 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• baptisteArno

Name

• typebot.io

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14
• 3.15

License

• open-source

Website

• Product: https://github.com/baptisteArno/typebot.io/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion