CVE-2026-42142: CWE-862: Missing Authorization in baptisteArno typebot.io
TypeBot is a chatbot builder tool. Prior to version 3.17.0, the `handleGetSheets` API handler (`POST /api/sheets/getSheets`) does not validate workspace membership, allowing any authenticated user to access and decrypt another workspace's Google Sheets OAuth credentials and retrieve spreadsheet data (sheet names, IDs, column headers). Version 3.17.0 fixes the issue.
AI Analysis
Technical Summary
TypeBot versions before 3.17.0 contain a missing authorization vulnerability (CWE-862) in the POST /api/sheets/getSheets API handler. The handler does not verify if the requesting user belongs to the workspace whose Google Sheets OAuth credentials are being accessed. As a result, any authenticated user can obtain and decrypt OAuth credentials for other workspaces and retrieve spreadsheet data including sheet names, IDs, and column headers. This issue is resolved in version 3.17.0.
Potential Impact
An attacker with valid authentication can access sensitive Google Sheets OAuth credentials belonging to other workspaces and retrieve spreadsheet metadata. This compromises confidentiality of workspace data and could lead to unauthorized data exposure. The integrity and availability impacts are low as the vulnerability primarily affects confidentiality and does not allow modification or denial of service.
Mitigation Recommendations
Upgrade TypeBot to version 3.17.0 or later, where this missing authorization issue is fixed. Patch status is confirmed by the vendor stating the fix in 3.17.0. No other mitigations are specified.
CVE-2026-42142: CWE-862: Missing Authorization in baptisteArno typebot.io
Description
TypeBot is a chatbot builder tool. Prior to version 3.17.0, the `handleGetSheets` API handler (`POST /api/sheets/getSheets`) does not validate workspace membership, allowing any authenticated user to access and decrypt another workspace's Google Sheets OAuth credentials and retrieve spreadsheet data (sheet names, IDs, column headers). Version 3.17.0 fixes the issue.
CVSS v3.1
Score 7.1high
Affected software
pkg:github/baptistearno/typebot.ioRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
TypeBot versions before 3.17.0 contain a missing authorization vulnerability (CWE-862) in the POST /api/sheets/getSheets API handler. The handler does not verify if the requesting user belongs to the workspace whose Google Sheets OAuth credentials are being accessed. As a result, any authenticated user can obtain and decrypt OAuth credentials for other workspaces and retrieve spreadsheet data including sheet names, IDs, and column headers. This issue is resolved in version 3.17.0.
Potential Impact
An attacker with valid authentication can access sensitive Google Sheets OAuth credentials belonging to other workspaces and retrieve spreadsheet metadata. This compromises confidentiality of workspace data and could lead to unauthorized data exposure. The integrity and availability impacts are low as the vulnerability primarily affects confidentiality and does not allow modification or denial of service.
Mitigation Recommendations
Upgrade TypeBot to version 3.17.0 or later, where this missing authorization issue is fixed. Patch status is confirmed by the vendor stating the fix in 3.17.0. No other mitigations are specified.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-24T17:15:21.834Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7b49e7bf8831d53902c3a1
Added to database: 08/11/2026, 16:12:23 UTC
Last enriched: 08/11/2026, 16:27:36 UTC
Last updated: 08/11/2026, 18:43:13 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.