---
id: CVE-2026-42142
title: TypeBot is a chatbot builder tool
summary: >-
  TypeBot is a chatbot builder tool. Prior to version 3.17.0, the
  `handleGetSheets` API handler (`POST /api/sheets/getSheets`) does not validate
  workspace membership, allowing any authenticated user to access and decrypt
  another workspace'…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'
cwe:
  - CWE-862
published: '2026-08-11'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T20:46:02.457'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-42142'
references:
  - url: >-
      https://github.com/baptisteArno/typebot.io/commit/91d2a986d942232b98c066fc460d7c48c04a464b
    label: security-advisories@github.com
  - url: 'https://github.com/baptisteArno/typebot.io/pull/2467'
    label: security-advisories@github.com
  - url: 'https://github.com/baptisteArno/typebot.io/releases/tag/v3.17.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-7jr4-r73c-h4h9
    label: security-advisories@github.com
  - url: >-
      https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-7jr4-r73c-h4h9
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00369
epssPercentile: 0.28067
ingestedAt: '2026-09-09T21:22:45.527Z'
---

## Overview

TypeBot is a chatbot builder tool. Prior to version 3.17.0, the `handleGetSheets` API handler (`POST /api/sheets/getSheets`) does not validate workspace membership, allowing any authenticated user to access and decrypt another workspace's Google Sheets OAuth credentials and retrieve spreadsheet data (sheet names, IDs, column headers). Version 3.17.0 fixes the issue.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.