CVE-2026-62861: Baptistearno Typebot.io

Medium severity, CVSS 6.4. EPSS: 0.4% chance of exploitation in the next 30 days.

TypeBot is a chatbot builder tool. Prior to 3.18.0, any authenticated non-guest workspace member can remove another workspace's public custom domain and make typebots on that domain unavailable. The custom-domain delete handler in handleDeleteCustomDomain.ts authorizes a caller against a client-supplied workspaceId but sends the client-supplied domain name to the shared Vercel project before verifying that the domain belongs to that workspace. This issue is fixed in version 3.18.0.

Affected products

• Baptistearno Typebot.io: before 3.18.0 (fixed in 3.18.0)

Published 2026-08-25. Last modified 2026-09-09.