Is CVE-2026-48759 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48759 being exploited in the wild.

How severe is CVE-2026-48759?

High severity, with a CVSS score of 7.1, published 17 June 2026.

Is there a fix for CVE-2026-48759?

A patch was published on 2026-04-08: Version 3.16.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48759 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-48759?

Check whether you run Typebot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48759: baptisteArno TypeBot IDOR in theme template handlers

CVE-2026-48759 · Severity: high · CVSS 7.1 · Published 2026-06-17

TypeBot, a chatbot building platform, contains a security flaw that allows users to modify or delete chatbot theme templates belonging to other organizations or workspaces. By exploiting this issue, an authorized user on the platform could intentionally corrupt or remove the visual branding and design templates of other customers. This could lead to unauthorized design changes or service disruptions for affected chatbot users.

Technologies: Typebot. Vendors: Typebot.

Quick answers

Is CVE-2026-48759 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48759 being exploited in the wild.
How severe is CVE-2026-48759?: High severity, with a CVSS score of 7.1, published 17 June 2026.
Which products and versions are affected?: Typebot <= 3.15.2.
Is there a fix for CVE-2026-48759?: A patch was published on 2026-04-08: Version 3.16.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48759 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-48759?: Check whether you run Typebot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in the handleSaveThemeTemplate and handleDeleteThemeTemplate handlers of TypeBot. While the application validates that the requesting user is a member of the workspace ID provided in the request, the subsequent Prisma database queries for updating or deleting templates use only the themeTemplateId in the WHERE clause. Because the workspaceId is not included in the database filter, an attacker can provide their own valid workspace ID to pass the initial authorization check while targeting a template ID belonging to a different workspace. This allows for cross-workspace modification and deletion of templates. The vulnerability is fixed in version 3.16.0 by ensuring database operations are scoped to both the template ID and the verified workspace ID.

Affected products

baptisteArno typebot.io <= 3.15.2

Timeline

2026-04-08: patched: Version 3.16.0 released
2026-05-24: advisory: GitHub Security Advisory published
2026-06-17: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.