TypeBot versions before 3.17.0 have a missing authorization flaw (CWE-862) in the Google Sheets OAuth callback. The callback route authenticates users but does not verify that the authenticated user has write access to the workspace or TypeBot referenced in the base64-encoded JSON state parameter. This state parameter includes workspaceId, typebotId, blockId, and redirectUrl, which are trusted without cryptographic integrity protection or authorization checks. An attacker with a valid Google OAuth code can manipulate the state to create or update Google Sheets credentials in other users' workspaces or attach credentials to blocks in other TypeBots if the target IDs are known. The vulnerability is fixed in version 3.17.0.

An authenticated user with a valid Google OAuth code can escalate privileges by creating or modifying Google Sheets credentials in workspaces they do not have write access to. This can lead to unauthorized access and modification of data within other users' workspaces or TypeBots. The confidentiality and integrity of data linked to Google Sheets integrations can be compromised. There is no indication of availability impact. No known exploits are reported in the wild.

Upgrade TypeBot to version 3.17.0 or later, where this missing authorization vulnerability is patched. Since no official patch links or advisories are provided, verify the upgrade through the vendor's official channels. Until upgraded, restrict access to authenticated users with valid Google OAuth codes and monitor for suspicious activity related to Google Sheets credential creation or modification.