CVE-2026-48767

Name of the Vulnerable Software and Affected Versions TypeBot versions prior to 3.17.0

Description A low-privilege guest member of a workspace can obtain a live Google Sheets OAuth access token by calling the Google Sheets helper getAccessToken. The system only verifies if the caller has read access to the workspace before decrypting the stored Google OAuth credential and returning the raw bearer token. Additionally, guest members can enumerate credential identifiers, allowing them to generate and use the workspace's Google access token outside the application.

Recommendations Update to version 3.17.0.