PT-2026-42820 · Typebot · Typebot

CVE-2026-39966 · Published 2026-05-22 · Updated 2026-05-22

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions TypeBot versions prior to 3.16.0

Description An Insecure Direct Object Reference (IDOR) exists in the 'getLinkedTypebots' API endpoint. The issue occurs because the authorization check utilizes Array.filter() with an asynchronous callback. Since filter() is a synchronous function, the callback returns a truthy Promise, causing the access control predicate to be bypassed. Consequently, any authenticated user can access full bot definitions from other workspaces by referencing a target bot ID in a Typebot Link block. This exposure includes conversation blocks, logic flow, webhook URLs, integration configurations, and embedded variable values such as API keys, credentials, and personally identifiable information (PII).

Recommendations Update to version 3.16.0.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-39966

GHSA-3FR5-999R-84QJ

Affected Products

Typebot

References · 7

• 🔥 https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-3fr5-999r-84qj · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39966.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-39966 · Security Note
• https://osv.dev/vulnerability/CVE-2026-39966 · Vendor Advisory
• https://github.com/baptisteArno/typebot.io/commit/b9530a089b43bfa6e79e3ff9cbfab921ce832f45 · Note
• https://github.com/baptisteArno/typebot.io/releases/tag/v3.16.0 · Note
• https://t.me/CVEtracker/54656 · Telegram Post