CVE-2026-39967
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
In TypeBot up to version 3.15.2, the bot engine's findResult query does not filter by typebotId, allowing an authenticated user to load result data from another typebot by supplying a foreign resultId to the startChat endpoint. This issue is fixed in version 3.16.0.
Risk Assessment
The risk is potential exposure of PII (names, emails, phone numbers) from previous users if the attacker meets certain conditions.
Recommendation
Immediately update TypeBot to version 3.16.0 or later, which contains the fix.
Original NVD description (English source)
TypeBot is a chatbot builder tool. In versions 3.15.2 and prior, the bot engine's the findResult query does not filter results by typebotId, allowing an authenticated user to load result data (user answers, variable values) from a different typebot by supplying a foreign resultId to the startChat endpoint. Exploitation is constrained by CUID2's cryptographically random 24-character IDs (making brute-force infeasible), the requirement that rememberUser be enabled, and the need for matching variable names in the current typebot. If successfully exploited, an attacker can access the original user's previous answers, session variable values, and hasStarted flag, potentially exposing PII like names, emails, and phone numbers. This issue has been fixed in version 3.16.0.