CVE-2026-42142
HighCVSS 7.1Summary
TypeBot before version 3.17.0 in the `handleGetSheets` API handler does not validate workspace membership, allowing any authenticated user to access and decrypt another workspace's Google Sheets OAuth credentials and retrieve spreadsheet data. Version 3.17.0 fixes the issue.
Risk Assessment
The risk involves unauthorized access to sensitive data in Google Sheets and leakage of OAuth credentials, potentially leading to privacy breaches and data integrity issues.
Recommendation
Upgrade TypeBot to version 3.17.0 or later. Also implement proper access control in the API to verify workspace membership.
Original NVD description (English source)
TypeBot is a chatbot builder tool. Prior to version 3.17.0, the `handleGetSheets` API handler (`POST /api/sheets/getSheets`) does not validate workspace membership, allowing any authenticated user to access and decrypt another workspace's Google Sheets OAuth credentials and retrieve spreadsheet data (sheet names, IDs, column headers). Version 3.17.0 fixes the issue.