CVE-2026-48767

TypeBot (workspace chatbot builder) before v3.17.0 is affected. A low-privilege guest can call the Google Sheets helper getAccessToken to decrypt and retrieve the workspace’s Google Sheets OAuth token, and return the raw bearer token to the caller, enabling token minting/reuse outside TypeBot. Th...