CVE-2026-62861 baptisteArno CVE debrief

Who should care

Defenders responsible for TypeBot deployments should assess exposure and prioritize updating to version 3.18.0 to prevent unauthorized domain removal. This includes verifying workspace configurations, monitoring for suspicious activity related to custom domain removal, and ensuring that only authorized personnel can manage custom domains.

Why it matters

CVE-2026-62861 allows authenticated non-guest workspace members to remove public custom domains in TypeBot, making typebots unavailable. Defenders should prioritize verifying workspace configurations and updating to version 3.18.0.

• Verify workspace configurations to prevent unauthorized domain removal
• Update to version 3.18.0 to fix the issue
• Monitor for suspicious activity related to custom domain removal

Technical summary

Authenticated non-guest workspace members can remove public custom domains in TypeBot, making typebots unavailable. This issue is due to improper authorization in the custom-domain delete handler, which authorizes a caller against a client-supplied workspaceId but sends the client-supplied domain name to the shared Vercel project before verifying that the domain belongs to that workspace. The issue is fixed in version 3.18.0. Defenders should prioritize verifying workspace configurations and updating to version 3.18.0 to prevent unauthorized domain removal.

Defensive priority

Defenders should prioritize verifying workspace configurations and updating to version 3.18.0 to prevent unauthorized domain removal.

Recommended defensive actions

• Verify workspace configurations to prevent unauthorized domain removal
• Update to version 3.18.0 to fix the issue
• Monitor for suspicious activity related to custom domain removal
• Confirm whether affected TypeBot deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

Evidence from the CVE record and source references indicates that authenticated non-guest workspace members can remove public custom domains, making typebots unavailable. This issue is fixed in version 3.18.0.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.