Skip to content
OpenAdvisories
High · 7.1 CVE-2026-42142 EUVD-2026-56235

TypeBot has Authorization Bypass in Google Sheets `getSheets` Endpoint that Allows Cross-Workspace Credential Access

Published Aug 11, 2026 · Updated Aug 11, 2026 · Assigned by GitHub_M

Description

TypeBot is a chatbot builder tool. Prior to version 3.17.0, the `handleGetSheets` API handler (`POST /api/sheets/getSheets`) does not validate workspace membership, allowing any authenticated user to access and decrypt another workspace's Google Sheets OAuth credentials and retrieve spreadsheet data (sheet names, IDs, column headers). Version 3.17.0 fixes the issue.

Affected products

VendorProductAffectedFixed
baptisteArno typebot.io < 3.17.0 —

References