High severity7.1NVD Advisory· Published Aug 11, 2026· Updated Aug 11, 2026
CVE-2026-42142
CVE-2026-42142
Description
TypeBot is a chatbot builder tool. Prior to version 3.17.0, the handleGetSheets API handler (POST /api/sheets/getSheets) does not validate workspace membership, allowing any authenticated user to access and decrypt another workspace's Google Sheets OAuth credentials and retrieve spreadsheet data (sheet names, IDs, column headers). Version 3.17.0 fixes the issue.
Affected products
1- Range: <3.17.0
Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.