PT-2025-46875 · Typebot · Typebot

Published 2025-11-13 · Updated 2026-01-30 · CVE-2025-64706

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Typebot versions 3.9.0 through 3.12.9

Description Typebot is an open-source chatbot builder. An Insecure Direct Object Reference (IDOR) vulnerability exists in the API token management endpoint. An authenticated attacker can delete any user's API token and retrieve its value by knowing the target user's ID and token ID, without authorization checks. The vulnerable API endpoint does not properly validate access permissions, allowing unauthorized modification of resources. The user id and token id are directly used to access and manipulate API tokens.

Recommendations Upgrade to Typebot version 3.13.0 or later.

Exploit

Fix

Improper Access Control

IDOR

Weakness Enumeration

CWE-284

CWE-639

Related Identifiers

CVE-2025-64706

GHSA-GRX8-G27P-8HPP

Affected Products

Typebot

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64706.json · Exploit
• https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-grx8-g27p-8hpp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64706 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64706 · Security Note
• https://t.me/cveNotify/150395 · Telegram Post
• https://t.me/CVEtracker/37277 · Telegram Post