CVE-2026-48759: Baptistearno Typebot.io

High severity, CVSS 7.1. EPSS: 0.4% chance of exploitation in the next 30 days.

TypeBot is a chatbot builder tool. Versions 3.15.2 and below have an Insecure Direct Object Reference vulnerability through cross-workspace Theme Template modification and deletion. The handleSaveThemeTemplate and handleDeleteThemeTemplate handlers validate that the authenticated user is a non-guest member of the provided workspaceId, but then operate on themeTemplateId via Prisma queries that do NOT include workspaceId in the WHERE clause. This allows any authenticated user to modify or delete theme templates belonging to any other workspace and may expose Template IDs via shared typebots or network traffic. This issue has been fixed in version 3.16.0.

Affected products

• Baptistearno Typebot.io: before 3.16.0 (fixed in 3.16.0)

Published 2026-06-17. Last modified 2026-06-22.