CVE-2026-48495 baptisteArno CVE debrief

Who should care

Defenders who manage TypeBot installations and Google Sheets credentials should be aware of this vulnerability and take steps to verify their installations and ensure they are updated to version 3.17.0 or later.

Why it matters

CVE-2026-48495 is a vulnerability in TypeBot that allows an authenticated user to create Google Sheets credentials in another workspace and attach them to a block in another Typebot. Defenders should verify their TypeBot installations and Google Sheets credentials, and monitor for suspicious activity.

• An authenticated user can create Google Sheets credentials in another workspace.
• An authenticated user can attach Google Sheets credentials to a block in another Typebot if the target IDs are known.
• Defenders need to verify TypeBot installations and Google Sheets credentials for unauthorized changes.
• Defenders need to monitor Typebot group changes and Google Sheets credential creation for suspicious activity.

Technical summary

The Google Sheets OAuth callback in TypeBot prior to version 3.17.0 decodes a base64-encoded JSON `state` parameter and trusts the embedded `workspaceId`, `typebotId`, `blockId`, and `redirectUrl` without cryptographic integrity protection or authorization checks. This allows an authenticated user to create Google Sheets credentials in another workspace and attach them to a block in another Typebot if the target IDs are known.

Defensive priority

Defenders should prioritize verifying their TypeBot installations and ensuring they are updated to version 3.17.0 or later. They should also review their Google Sheets credentials and Typebot groups for any unauthorized changes.

Recommended defensive actions

• Verify TypeBot installations and ensure they are updated to version 3.17.0 or later.
• Review Google Sheets credentials and Typebot groups for any unauthorized changes.
• Monitor Typebot group changes and Google Sheets credential creation for suspicious activity.
• Perform an inventory of TypeBot installations to identify potential exposure.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The evidence for this vulnerability comes from the CVE Program record and the NIST National Vulnerability Database. The vulnerability was patched in version 3.17.0 of TypeBot. Evidence is limited to public CVE and NVD records. Defenders should verify TypeBot installations, review Google Sheets credentials, and monitor for suspicious activity related to Google Sheets credential creation and Typebot group changes within their environments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.