CVE-2026-48767 is an information exposure vulnerability in TypeBot (a chatbot builder tool) affecting versions before 3.17.0. A low-privilege guest member with read access to a workspace can call the Google Sheets helper getAccessToken, which decrypts and refreshes the stored Google OAuth credential and returns the raw bearer token. Since guest members can enumerate credential identifiers, they can mint and reuse the workspace's Google access token externally, leading to unauthorized access to sensitive information.

An attacker with guest-level access to a workspace can obtain a live Google Sheets OAuth access token, enabling unauthorized access to Google Sheets data associated with the workspace. This compromises confidentiality (high impact), with limited integrity and availability impact as per the CVSS vector. The attacker can reuse the token outside TypeBot, potentially accessing or manipulating sensitive data in Google Sheets beyond the intended scope.

Upgrade TypeBot to version 3.17.0 or later, where this vulnerability is patched. Since the vendor advisory or patch links are not explicitly provided, confirm the upgrade path with official vendor sources. Until patched, restrict guest member permissions to prevent unauthorized access to sensitive OAuth tokens.