Vulnerabilities CVE-2026-42142

CVE-2026-42142

High

Open

TLP:CLEAR

TypeBot has Authorization Bypass in Google Sheets `getSheets` Endpoint that Allows Cross-Workspace Credential Access

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

TypeBot is a chatbot builder tool. Prior to version 3.17.0, the `handleGetSheets` API handler (`POST /api/sheets/getSheets`) does not validate workspace membership, allowing any authenticated user to access and decrypt another workspace's Google Sheets OAuth credentials and retrieve spreadsheet data (sheet names, IDs, column headers). Version 3.17.0 fixes the issue.

Details

CVSS Score: 7.1
EPSS Score ⓘ: 0.27%

19.3th percentile
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Confidence: 90%
Published: Aug 11, 2026
Last Modified: Aug 11, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.