CVE-2026-48494

Name of the Vulnerable Software and Affected Versions TypeBot versions prior to 3.17.0

Description An authenticated user with read access to any typebot can resume a WhatsApp preview webhook session belonging to a different typebot. This occurs because the WhatsApp test-webhook handler authorizes the parent typebot but resolves the preview chat session using only the wa-preview-{phone} identifier. By combining an authorized typebotId and blockId with a foreign preview phone number, an attacker can inject arbitrary webhook JSON into another workspace's WhatsApp preview session and advance its draft or unpublished flow without having access to the victim typebot.

Recommendations Update to version 3.17.0.