PT-2026-42824 · Typebot · Typebot

Enestayboga · CVE-2026-39967 · Published 2026-05-22 · Updated 2026-05-23

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions TypeBot versions prior to 3.16.0

Description An issue in the bot engine's findResult query fails to filter results by typebotId. This allows an authenticated user to load result data, including user answers and variable values, from a different typebot by providing a foreign resultId to the 'startChat' endpoint. Successful exploitation can expose personally identifiable information (PII) such as names, emails, and phone numbers, as well as session variable values and the hasStarted flag. Exploitation requires rememberUser to be enabled and matching variable names in the current typebot. The use of CUID2 (cryptographically random 24-character IDs) makes brute-forcing the resultId infeasible.

Recommendations Update to version 3.16.0.

Exploit

Fix

Missing Authorization

IDOR

Weakness Enumeration

CWE-862

CWE-639

Related Identifiers

CVE-2026-39967

GHSA-F475-7M4X-M6MX

Affected Products

Typebot

References · 9

• 🔥 https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-f475-7m4x-m6mx · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39967.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-39967 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39967 · Security Note
• https://github.com/baptisteArno/typebot.io/releases/tag/v3.16.0 · Note
• https://github.com/baptisteArno/typebot.io/commit/73162634e6bdebd37a1a571db4062d30854e0400 · Note
• https://twitter.com/CVEnew/status/2058155796685578586 · Twitter Post
• https://twitter.com/infoflowcloud/status/2058156373414662267 · Twitter Post
• https://t.me/CVEtracker/54659 · Telegram Post