CVE-2026-47702

CriticalCVSS 9.1

Published: 11/08/2026(UTC)Translated: 11/08/2026(UTC)NVD NIST

Summary

TypeBot version 3.16.1 stores API tokens in the database as cleartext. An attacker with database read access can extract all tokens and impersonate any user without password or MFA.

Risk Assessment

Exposed API tokens allow full account compromise and access to sensitive data, leading to privacy breaches and system integrity issues.

Recommendation

Upgrade TypeBot to version 3.17.0 or later. Immediately rotate all API tokens and secure database access.

Original NVD description (English source)

TypeBot is a chatbot builder tool. In version 3.16.1, API tokens (bearer credentials used to authenticate against the builder API) are stored in the database as cleartext strings. An attacker who gains read access to the database (e.g., via SQL injection, backup exposure, or insider access) can extract all API tokens and impersonate any user without requiring a password or multi-factor authentication. Version 3.17.0 fixes the issue.