Webhook Execution Flaw in TypeBot Affecting Authorized Users

CVE-2026-47704

What is CVE-2026-47704?

TypeBot, a versatile chatbot builder tool, is susceptible to a vulnerability that allows an authenticated user with read access to resume a webhook session from a different typebot. By manipulating an authorized typebotId and blockId alongside a foreign resultId, an attacker can inject arbitrary JSON into another typebot's suspended session, thereby advancing its execution without direct access to the targeted typebot. This security issue, addressed in version 3.17.0, underlines the importance of rigorous authorization checks.

References