CVE-2026-39967

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39967", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-08T00:01:47.627Z", "datePublished": "2026-05-22T18:36:23.724Z", "dateUpdated": "2026-05-26T19:05:32.122Z"}, "containers": {"cna": {"title": "TypeBot: Cross-Typebot Result Data Access via Missing typebotId Filter", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-f475-7m4x-m6mx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-f475-7m4x-m6mx"}, {"name": "https://github.com/baptisteArno/typebot.io/commit/73162634e6bdebd37a1a571db4062d30854e0400", "tags": ["x_refsource_MISC"], "url": "https://github.com/baptisteArno/typebot.io/commit/73162634e6bdebd37a1a571db4062d30854e0400"}, {"name": "https://github.com/baptisteArno/typebot.io/releases/tag/v3.16.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/baptisteArno/typebot.io/releases/tag/v3.16.0"}], "affected": [{"vendor": "baptisteArno", "product": "typebot.io", "versions": [{"version": "< 3.16.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-22T18:36:23.724Z"}, "descriptions": [{"lang": "en", "value": "TypeBot is a chatbot builder tool. In versions 3.15.2 and prior, the bot engine's the findResult query does not filter results by typebotId, allowing an authenticated user to load result data (user answers, variable values) from a different typebot by supplying a foreign resultId to the startChat endpoint. Exploitation is constrained by CUID2's cryptographically random 24-character IDs (making brute-force infeasible), the requirement that rememberUser be enabled, and the need for matching variable names in the current typebot. If successfully exploited, an attacker can access the original user's previous answers, session variable values, and hasStarted flag, potentially exposing PII like names, emails, and phone numbers. This issue has been fixed in version 3.16.0."}], "source": {"advisory": "GHSA-f475-7m4x-m6mx", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-f475-7m4x-m6mx", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-26T19:05:13.766138Z", "id": "CVE-2026-39967", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-26T19:05:32.122Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-39967", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-26T19:05:13.766138Z"}}}], "references": [{"url": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-f475-7m4x-m6mx", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-26T19:05:28.610Z"}}], "cna": {"title": "TypeBot: Cross-Typebot Result Data Access via Missing typebotId Filter", "source": {"advisory": "GHSA-f475-7m4x-m6mx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "baptisteArno", "product": "typebot.io", "versions": [{"status": "affected", "version": "< 3.16.0"}]}], "references": [{"url": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-f475-7m4x-m6mx", "name": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-f475-7m4x-m6mx", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/baptisteArno/typebot.io/commit/73162634e6bdebd37a1a571db4062d30854e0400", "name": "https://github.com/baptisteArno/typebot.io/commit/73162634e6bdebd37a1a571db4062d30854e0400", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/baptisteArno/typebot.io/releases/tag/v3.16.0", "name": "https://github.com/baptisteArno/typebot.io/releases/tag/v3.16.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "TypeBot is a chatbot builder tool. In versions 3.15.2 and prior, the bot engine's the findResult query does not filter results by typebotId, allowing an authenticated user to load result data (user answers, variable values) from a different typebot by supplying a foreign resultId to the startChat endpoint. Exploitation is constrained by CUID2's cryptographically random 24-character IDs (making brute-force infeasible), the requirement that rememberUser be enabled, and the need for matching variable names in the current typebot. If successfully exploited, an attacker can access the original user's previous answers, session variable values, and hasStarted flag, potentially exposing PII like names, emails, and phone numbers. This issue has been fixed in version 3.16.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-22T18:36:23.724Z"}}}, "cveMetadata": {"cveId": "CVE-2026-39967", "state": "PUBLISHED", "dateUpdated": "2026-05-26T19:05:32.122Z", "dateReserved": "2026-04-08T00:01:47.627Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-22T18:36:23.724Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "typebot.io", "vendor": "baptisteArno", "versions": [{"status": "affected", "version": "< 3.16.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "TypeBot is a chatbot builder tool. In versions 3.15.2 and prior, the bot engine's the findResult query does not filter results by typebotId, allowing an authenticated user to load result data (user answers, variable values) from a different typebot by supplying a foreign resultId to the startChat endpoint. Exploitation is constrained by CUID2's cryptographically random 24-character IDs (making brute-force infeasible), the requirement that rememberUser be enabled, and the need for matching variable names in the current typebot. If successfully exploited, an attacker can access the original user's previous answers, session variable values, and hasStarted flag, potentially exposing PII like names, emails, and phone numbers. This issue has been fixed in version 3.16.0."}, {"lang": "es", "value": "TypeBot es una herramienta de creaci\u00f3n de chatbots. En las versiones 3.15.2 y anteriores, la consulta findResult del motor del bot no filtra los resultados por typebotId, permitiendo a un usuario autenticado cargar datos de resultados (respuestas de usuario, valores de variables) de un typebot diferente al proporcionar un resultId ajeno al endpoint startChat. La explotaci\u00f3n est\u00e1 limitada por los IDs criptogr\u00e1ficamente aleatorios de 24 caracteres de CUID2 (haciendo inviable la fuerza bruta), el requisito de que rememberUser est\u00e9 habilitado y la necesidad de nombres de variables coincidentes en el typebot actual. Si se explota con \u00e9xito, un atacante puede acceder a las respuestas anteriores del usuario original, los valores de las variables de sesi\u00f3n y el flag hasStarted, exponiendo potencialmente PII como nombres, correos electr\u00f3nicos y n\u00fameros de tel\u00e9fono. Este problema ha sido solucionado en la versi\u00f3n 3.16.0."}], "id": "CVE-2026-39967", "lastModified": "2026-07-23T16:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39967", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-26T19:05:13.766138Z", "version": "2.0.3"}}]}, "published": "2026-05-22T19:17:03.243", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/baptisteArno/typebot.io/commit/73162634e6bdebd37a1a571db4062d30854e0400"}, {"source": "security-advisories@github.com", "url": "https://github.com/baptisteArno/typebot.io/releases/tag/v3.16.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-f475-7m4x-m6mx"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-f475-7m4x-m6mx"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}, {"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.16.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "typebot.io", "source": "cna", "vendor": "baptisteArno"}, "product": "typebot.io", "vendor": "baptistearno"}], "created": "2026-05-22T20:30:06.076133+00:00", "updated": "2026-05-25T11:33:53.362616+00:00", "vendors": ["baptistearno", "baptistearno$PRODUCT$typebot.io"]}