CVE-2026-48765

creationtimestamp| type| source ---|---|--- 2026-08-11 22:01:44+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mstmivp3o423 2026-08-11 23:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mstryqmxf52b 2026-08-12 06:00:28+00:00| seen|...

CVE-2026-48765 TypeBot vulnerable to cross-workspace OAuth credential takeover in updateOAuthCredentials via missing object binding

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth credentialsId from a readable bot configuration and then overwrite that credential through handleUpdateOAuthCredentials by supplying an attacker-controlled writable...

CVE-2026-48765 TypeBot vulnerable to cross-workspace OAuth credential takeover in updateOAuthCredentials via missing object binding

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth credentialsId from a readable bot configuration and then overwrite that credential through handleUpdateOAuthCredentials by supplying an attacker-controlled writable...