Improper Access Control in TypeBot Chatbot Builder by Typebot.io

CVE-2026-39966

What is CVE-2026-39966?

TypeBot, a chatbot builder tool, has reported an improper access control vulnerability that allows authenticated users to access sensitive information from other workspaces. The vulnerability arises from the getLinkedTypebots API endpoint, which fails to properly evaluate access control due to a flaw in its authorization check mechanism. This results in any authenticated user being able to retrieve full bot definitions—including conversation blocks, logic flows, variable values, and sensitive configurations—without the necessary permissions. The issue was resolved in version 3.16.0, and users are strongly encouraged to upgrade to protect their data.

References