CVE-2026-48767

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48767", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-22T19:39:05.356Z", "datePublished": "2026-08-11T17:13:51.925Z", "dateUpdated": "2026-08-11T17:45:14.220Z"}, "containers": {"cna": {"title": "Google Sheets OAuth access token disclosure to guest members via getAccessToken", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-qjpp-9cqc-jhh8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-qjpp-9cqc-jhh8"}, {"name": "https://github.com/baptisteArno/typebot.io/pull/2501", "tags": ["x_refsource_MISC"], "url": "https://github.com/baptisteArno/typebot.io/pull/2501"}, {"name": "https://github.com/baptisteArno/typebot.io/commit/c0ffd825e2f4ee2256a157fd085fb624dcede625", "tags": ["x_refsource_MISC"], "url": "https://github.com/baptisteArno/typebot.io/commit/c0ffd825e2f4ee2256a157fd085fb624dcede625"}, {"name": "https://github.com/baptisteArno/typebot.io/releases/tag/v3.17.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/baptisteArno/typebot.io/releases/tag/v3.17.0"}], "affected": [{"vendor": "baptisteArno", "product": "typebot.io", "versions": [{"version": "< 3.17.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-11T17:13:51.925Z"}, "descriptions": [{"lang": "en", "value": "TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to obtain a live Google Sheets OAuth access token for that workspace by calling the Google Sheets helper `getAccessToken`. The vulnerable path checks only whether the caller has read access to the workspace, decrypts the stored Google OAuth credential, refreshes or retrieves the access token through the Google client, and returns the raw bearer token directly to the caller. Because guest members can also enumerate credential identifiers, a guest can mint and reuse the workspace's Google access token outside Typebot. Version 3.17.0 patches the issue."}], "source": {"advisory": "GHSA-qjpp-9cqc-jhh8", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-qjpp-9cqc-jhh8", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-11T17:44:40.760742Z", "id": "CVE-2026-48767", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T17:45:14.220Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48767", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T17:44:40.760742Z"}}}], "references": [{"url": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-qjpp-9cqc-jhh8", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T17:45:08.330Z"}}], "cna": {"title": "Google Sheets OAuth access token disclosure to guest members via getAccessToken", "source": {"advisory": "GHSA-qjpp-9cqc-jhh8", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "baptisteArno", "product": "typebot.io", "versions": [{"status": "affected", "version": "< 3.17.0"}]}], "references": [{"url": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-qjpp-9cqc-jhh8", "name": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-qjpp-9cqc-jhh8", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/baptisteArno/typebot.io/pull/2501", "name": "https://github.com/baptisteArno/typebot.io/pull/2501", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/baptisteArno/typebot.io/commit/c0ffd825e2f4ee2256a157fd085fb624dcede625", "name": "https://github.com/baptisteArno/typebot.io/commit/c0ffd825e2f4ee2256a157fd085fb624dcede625", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/baptisteArno/typebot.io/releases/tag/v3.17.0", "name": "https://github.com/baptisteArno/typebot.io/releases/tag/v3.17.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to obtain a live Google Sheets OAuth access token for that workspace by calling the Google Sheets helper `getAccessToken`. The vulnerable path checks only whether the caller has read access to the workspace, decrypts the stored Google OAuth credential, refreshes or retrieves the access token through the Google client, and returns the raw bearer token directly to the caller. Because guest members can also enumerate credential identifiers, a guest can mint and reuse the workspace's Google access token outside Typebot. Version 3.17.0 patches the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-11T17:13:51.925Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48767", "state": "PUBLISHED", "dateUpdated": "2026-08-11T17:45:14.220Z", "dateReserved": "2026-05-22T19:39:05.356Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-11T17:13:51.925Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "typebot.io", "vendor": "baptisteArno", "versions": [{"status": "affected", "version": "< 3.17.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to obtain a live Google Sheets OAuth access token for that workspace by calling the Google Sheets helper `getAccessToken`. The vulnerable path checks only whether the caller has read access to the workspace, decrypts the stored Google OAuth credential, refreshes or retrieves the access token through the Google client, and returns the raw bearer token directly to the caller. Because guest members can also enumerate credential identifiers, a guest can mint and reuse the workspace's Google access token outside Typebot. Version 3.17.0 patches the issue."}, {"lang": "es", "value": "TypeBot es una herramienta de creaci\u00f3n de chatbots. Las versiones anteriores a la 3.17.0 permiten a un miembro invitado con pocos privilegios de un espacio de trabajo obtener un token de acceso OAuth de Google Sheets activo para ese espacio de trabajo al llamar a la funci\u00f3n auxiliar de Google Sheets \u2019getAccessToken\u2019. La ruta vulnerable verifica \u00fanicamente si el llamador tiene acceso de lectura al espacio de trabajo, descifra la credencial OAuth de Google almacenada, actualiza o recupera el token de acceso a trav\u00e9s del cliente de Google y devuelve el token portador (bearer token) sin procesar directamente al llamador. Dado que los miembros invitados tambi\u00e9n pueden enumerar los identificadores de credenciales, un invitado puede acu\u00f1ar y reutilizar el token de acceso de Google del espacio de trabajo fuera de Typebot. La versi\u00f3n 3.17.0 corrige el problema."}], "id": "CVE-2026-48767", "lastModified": "2026-10-23T19:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48767", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-11T17:44:40.760742Z", "version": "2.0.3"}}]}, "published": "2026-08-11T18:17:33.470", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/baptisteArno/typebot.io/commit/c0ffd825e2f4ee2256a157fd085fb624dcede625"}, {"source": "security-advisories@github.com", "url": "https://github.com/baptisteArno/typebot.io/pull/2501"}, {"source": "security-advisories@github.com", "url": "https://github.com/baptisteArno/typebot.io/releases/tag/v3.17.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-qjpp-9cqc-jhh8"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-qjpp-9cqc-jhh8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.17.0)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "typebot.io", "source": "cna", "vendor": "baptisteArno"}, "product": "typebot.io", "vendor": "baptistearno"}], "created": "2026-08-12T14:00:03.513223+00:00", "updated": "2026-08-12T21:00:04.085595+00:00", "vendors": ["baptistearno", "baptistearno$PRODUCT$typebot.io"]}