Vulnerability Description
TypeBot is a chatbot builder tool. Prior to version 3.17.0, the `handleGetSheets` API handler (`POST /api/sheets/getSheets`) does not validate workspace membership, allowing any authenticated user to access and decrypt another workspace's Google Sheets OAuth credentials and retrieve spreadsheet data (sheet names, IDs, column headers). Version 3.17.0 fixes the issue.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/baptisteArno/typebot.io/commit/91d2a986d942232b98c066fc460d7c
- https://github.com/baptisteArno/typebot.io/pull/2467
- https://github.com/baptisteArno/typebot.io/releases/tag/v3.17.0
- https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-7jr4-r73c-h4
- https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-7jr4-r73c-h4
FAQ
What is CVE-2026-42142?
CVE-2026-42142 is a vulnerability with a CVSS score of 7.1 (HIGH). TypeBot is a chatbot builder tool. Prior to version 3.17.0, the `handleGetSheets` API handler (`POST /api/sheets/getSheets`) does not validate workspace membership, allowing any authenticated user to ...
How severe is CVE-2026-42142?
CVE-2026-42142 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-42142?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.