CVE-2026-47704

Name of the Vulnerable Software and Affected Versions TypeBot versions prior to 3.17.0

Description An authenticated user with read access to any chatbot can resume a waiting webhook session belonging to a different chatbot. This occurs because the webhook resume handler authorizes the parent chatbot first but resolves the descendant result using only the resultId variable. By combining an authorized typebotId and blockId with a foreign live resultId, an attacker can inject arbitrary webhook JSON into a suspended session and advance its execution without having access to the target chatbot.

Recommendations Update to version 3.17.0.