# CVE-2026-48766: TypeBot chatbot builder API key exfiltration via guest access

Source: https://junglewise.ai/threats/cve-2026-48766-typebot-chatbot-builder-api-key-exfiltration-via-guest-access  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-48766 · Severity: high · CVSS 7.6 · Published 2026-08-11

TypeBot is a no-code chatbot builder platform that stores API credentials (such as OpenAI keys) for workspace members. A guest user with minimal permissions can trick the application into sending their workspace's encrypted OpenAI API keys to an attacker-controlled server by manipulating the API model-listing function. This allows unauthorized exposure of sensitive credentials that control access to external AI services and associated costs.

Technologies: [Typebot](https://junglewise.ai/threats/technologies/typebot). Vendors: [Typebot](https://junglewise.ai/threats/vendors/typebot).

## Quick answers

**Is CVE-2026-48766 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48766 being exploited in the wild.

**How severe is CVE-2026-48766?** High severity, with a CVSS score of 7.6, published 11 August 2026.

**Which products and versions are affected?** Typebot prior to 3.17.0.

**Is there a fix for CVE-2026-48766?** A patch was published on 2026-04-15: Fix released in version 3.17.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48766 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-48766?** Check whether you run Typebot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass combined with credential leakage. The vulnerable OpenAI model-listing endpoint decrypts workspace credentials and creates an API client seeded with the secret, then sends outbound HTTP requests to a caller-supplied `baseUrl` parameter without validating the destination. The permission check only verifies that the user is a workspace member (including low-privilege guests), and the `listCredentials` function inadvertently reveals credential identifiers to guests, enabling them to select a target credential. An attacker with guest-level access can invoke the model-listing helper with an attacker-controlled URL, causing the server to exfiltrate the API key in both the request body and an explicit header. Version 3.17.0 patches the issue by enforcing write-access requirements on the endpoint.

## Affected products

- TypeBot TypeBot prior to 3.17.0

## Timeline

- 2026-08-11: disclosed
- 2026-04-15: patched: Fix released in version 3.17.0

## References

- [https://github.com/baptisteArno/typebot.io/commit/7ae4c007d0987d2ca907b47e1b7418db62b8a157](https://github.com/baptisteArno/typebot.io/commit/7ae4c007d0987d2ca907b47e1b7418db62b8a157)
- [https://github.com/baptisteArno/typebot.io/pull/2459](https://github.com/baptisteArno/typebot.io/pull/2459)

## Related threats

- [Typebot arbitrary local file read via Send Email attachment](https://junglewise.ai/threats/cve-2026-62865-typebot-arbitrary-local-file-read-via-send-email-attachment)
- [TypeBot custom domain deletion authorization bypass](https://junglewise.ai/threats/cve-2026-62861-typebot-custom-domain-deletion-authorization-bypass)
- [TypeBot privilege escalation in Google Sheets integration](https://junglewise.ai/threats/cve-2026-48767-typebot-privilege-escalation-in-google-sheets-integration)
- [TypeBot WhatsApp preview webhook authorization bypass](https://junglewise.ai/threats/cve-2026-48494-typebot-whatsapp-preview-webhook-authorization-bypass)
- [TypeBot CSV injection in result export](https://junglewise.ai/threats/cve-2026-47705-typebot-csv-injection-in-result-export)