CVE-2026-62861

Name of the Vulnerable Software and Affected Versions TypeBot versions prior to 3.18.0

Description An issue exists where an authenticated non-guest workspace member can remove a public custom domain belonging to another workspace, rendering the chatbots on that domain unavailable. The custom-domain delete handler in handleDeleteCustomDomain.ts authorizes the caller based on a client-supplied workspaceId but transmits the client-supplied domain name to the shared Vercel project before verifying if the domain actually belongs to the specified workspace.

Recommendations Update to version 3.18.0.