Executive brief
TypeBot is a chatbot-building platform that integrates with Google Sheets for data handling. Prior to version 3.17.0, a missing authorization check in the getSheets API endpoint allowed any authenticated user to bypass workspace isolation and access another workspace's Google Sheets credentials and spreadsheet data (sheet names, IDs, column headers), potentially exposing sensitive customer data.
Technical details
The vulnerability is an authorization bypass (missing access control) in the POST /api/sheets/getSheets endpoint. The handleGetSheets API handler failed to validate that the authenticated user belongs to the requested workspace before exposing Google Sheets OAuth credentials and spreadsheet metadata. An authenticated attacker could enumerate workspace IDs and retrieve sensitive data from workspaces they do not own. The fix adds workspace membership validation using the isReadWorkspaceForbidden check before calling getGoogleSpreadsheet, aligning with security patterns used by related endpoints. Version 3.17.0 and later are patched.
Affected products
- TypeBot TypeBot before 3.17.0
Timeline
- 2026-08-11: disclosed
- 2026-04-20: patched: Fix merged in version 3.17.0