CVE-2026-42142CWE-862broken-access-control

CVE-2026-42142

High · published August 11, 2026

CVSS v3.1

7.1

EPSS

Percentile

29.6

In the wild

Unconfirmed

What it is

TypeBot is a chatbot builder tool. Prior to version 3.17.0, the `handleGetSheets` API handler (`POST /api/sheets/getSheets`) does not validate workspace membership, allowing any authenticated user to access and decrypt another workspace's Google Sheets OAuth credentials and retrieve spreadsheet data (sheet names, IDs, column headers). Version 3.17.0 fixes the issue.

The record

Technical detail

CVSS v3.1: 7.1 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00369 · 29.6th percentile
Weakness: CWE-862 · Missing Authorization
Published: 2026-08-11T20:17Z

References (5)

https://github.com/baptisteArno/typebot.io/commit/91d2a986d942232b98c066fc460d7c48c04a464b · [email protected]https://github.com/baptisteArno/typebot.io/pull/2467 · [email protected]https://github.com/baptisteArno/typebot.io/releases/tag/v3.17.0 · [email protected]https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-7jr4-r73c-h4h9 · [email protected]https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-7jr4-r73c-h4h9 · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

11 AUG 15:45Z
TypeBot has Authorization Bypass in Google Sheets `getSheets` Endpoint that Allows Cross-Workspace Credential Access
cvelistv5