Description

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth `credentialsId` from a readable bot configuration and then overwrite that credential through `handleUpdateOAuthCredentials()` by supplying an attacker-controlled writable `workspaceId`. The update path validates only the attacker-supplied workspace and then updates the credential record by global `id` alone, while also rewriting the credential's `workspaceId`. This allows cross-workspace OAuth credential takeover and reassignment. Version 3.17.0 patches the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-11T21:17:36.947Z",
  "pubdate": "2026-08-11T21:17:36.947Z",
  "executiveSummary": "TypeBot versions prior to 3.17.0 suffer from an authorization bypass vulnerability affecting workspace OAuth credentials.\nThe flaw allows a low-privilege read collaborator to extract a workspace OAuth credentialsId from a readable bot configuration.\nUtilizing the extracted credentialsId, an authenticated attacker can overwrite the credential record by exploiting the handleUpdateOAuthCredentials() function.\nThe vulnerability enables cross-workspace OAuth credential takeover and reassignment through the supply of an attacker-controlled writable workspaceId.\nThe impact includes unauthorized modification and hijacking of sensitive OAuth credentials across different workspaces.\nExploitation requires low-privilege collaborator access to a readable bot configuration within the application.\nRisk implications involve severe authorization boundary violations and potential unauthorized access to integrated third-party services linked via OAuth credentials.",
  "technicalDetails": "The root cause of the vulnerability lies in broken object level authorization and insufficient input validation within the credential update mechanism of TypeBot.\nSpecifically, the vulnerable component is the handleUpdateOAuthCredentials() function, which fails to adequately validate whether the requesting user or the supplied context owns or possesses administrative rights over the targeted credential record.\nThe attack flow proceeds as follows: First, a low-privilege read collaborator accesses a readable bot configuration to extract a valid workspace OAuth credentialsId.\nSecond, the attacker leverages this identifier to invoke the handleUpdateOAuthCredentials() function, supplying an attacker-controlled writable workspaceId that they control or have access to.\nThird, the update path validates only the attacker-supplied workspace rather than verifying ownership of the global credential record, subsequently updating the credential record by its global id alone.\nFinally, the backend logic rewrites the credential's workspaceId, resulting in a cross-workspace OAuth credential takeover and reassignment.\nThe affected versions include all TypeBot instances prior to version 3.17.0.\nAuthentication requirements involve having low-privilege read collaborator access, meaning the attacker must be authenticated within the system.\nPost-exploitation impact includes the complete compromise of OAuth integrations, allowing unauthorized entities to manipulate or abuse credentials associated with different workspaces."
}