CVE-2026-48495

{"id": "CVE-2026-48495", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48495", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T14:41:43.888044Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "baptisteArno", "product": "typebot.io", "versions": [{"status": "affected", "version": "< 3.17.0"}]}]}], "published": "2026-08-11T16:17:32.170", "references": [{"url": "https://github.com/baptisteArno/typebot.io/commit/c0ffd825e2f4ee2256a157fd085fb624dcede625", "source": "security-advisories@github.com"}, {"url": "https://github.com/baptisteArno/typebot.io/pull/2501", "source": "security-advisories@github.com"}, {"url": "https://github.com/baptisteArno/typebot.io/releases/tag/v3.17.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-w789-9gxq-2xcj", "source": "security-advisories@github.com"}, {"url": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-w789-9gxq-2xcj", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "TypeBot is a chatbot builder tool. Prior to version 3.17.0, the Google Sheets OAuth callback decodes a base64-encoded JSON `state` parameter and trusts the embedded `workspaceId`, `typebotId`, `blockId`, and `redirectUrl` without cryptographic integrity protection or authorization checks. The callback route is authenticated, but it does not verify that the authenticated user has write access to the target workspace or Typebot before creating credentials in the workspace or updating Typebot groups. An authenticated user who can obtain a valid Google OAuth `code` can alter the `state` value to create Google Sheets credentials in another workspace and, if target IDs are known, attach those credentials to a block in another Typebot. Version 3.17.0 patches the issue."}, {"lang": "es", "value": "TypeBot es una herramienta de creaci\u00f3n de chatbots. Antes de la versi\u00f3n 3.17.0, la devoluci\u00f3n de llamada de OAuth de Google Sheets decodifica un par\u00e1metro \u2019state\u2019 JSON codificado en base64 y conf\u00eda en los \u2019workspaceId\u2019, \u2019typebotId\u2019, \u2019blockId\u2019 y \u2019redirectUrl\u2019 incrustados sin protecci\u00f3n de integridad criptogr\u00e1fica ni comprobaciones de autorizaci\u00f3n. La ruta de devoluci\u00f3n de llamada est\u00e1 autenticada, pero no verifica que el usuario autenticado tenga acceso de escritura al espacio de trabajo o Typebot de destino antes de crear credenciales en el espacio de trabajo o actualizar grupos de Typebot. Un usuario autenticado que puede obtener un \u2019code\u2019 de OAuth de Google v\u00e1lido puede alterar el valor de \u2019state\u2019 para crear credenciales de Google Sheets en otro espacio de trabajo y, si se conocen los ID de destino, adjuntar esas credenciales a un bloque en otro Typebot. La versi\u00f3n 3.17.0 corrige el problema."}], "lastModified": "2026-10-23T19:10:00.167", "sourceIdentifier": "security-advisories@github.com"}