Quick answers
- Is CVE-2026-48766 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-48766 being exploited in the wild.
- How severe is CVE-2026-48766?
- High severity, with a CVSS score of 7.6, published 11 August 2026.
- Which products and versions are affected?
- Typebot prior to 3.17.0.
- Is there a fix for CVE-2026-48766?
- A patch was published on 2026-04-15: Fix released in version 3.17.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-48766 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-48766?
- Check whether you run Typebot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an authorization bypass combined with credential leakage. The vulnerable OpenAI model-listing endpoint decrypts workspace credentials and creates an API client seeded with the secret, then sends outbound HTTP requests to a caller-supplied `baseUrl` parameter without validating the destination. The permission check only verifies that the user is a workspace member (including low-privilege guests), and the `listCredentials` function inadvertently reveals credential identifiers to guests, enabling them to select a target credential. An attacker with guest-level access can invoke the model-listing helper with an attacker-controlled URL, causing the server to exfiltrate the API key in both the request body and an explicit header. Version 3.17.0 patches the issue by enforcing write-access requirements on the endpoint.
Affected products
- TypeBot TypeBot prior to 3.17.0
Timeline
- 2026-08-11: disclosed
- 2026-04-15: patched: Fix released in version 3.17.0