Vulnerability · Published Jun 17, 2026 · Assigned by GitHub_M

CVE-2026-48759TypeBot: Cross-Workspace Theme Template IDOR (Modification and Deletion)

High 7.1

In plain English

A high-severity authorization bypass via user-controlled key in typebot.io from baptisteArno. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.2%top 89.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

TypeBot is a chatbot builder tool. Versions 3.15.2 and below have an Insecure Direct Object Reference vulnerability through cross-workspace Theme Template modification and deletion. The handleSaveThemeTemplate and handleDeleteThemeTemplate handlers validate that the authenticated user is a non-guest member of the provided workspaceId, but then operate on themeTemplateId via Prisma queries that do NOT include workspaceId in the WHERE clause. This allows any authenticated user to modify or delete theme templates belonging to any other workspace and may expose Template IDs via shared typebots or network traffic. This issue has been fixed in version 3.16.0.

Affected products (as reported)

Vendor	Product	Versions
baptisteArno	typebot.io	< 3.16.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

References

https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-qv4p-4mp3-pvpv x_refsource_CONFIRM
https://github.com/baptisteArno/typebot.io/releases/tag/v3.16.0 x_refsource_MISC