{"document":{"category":"csaf_vex","csaf_version":"2.0","title":"CVE-2026-48759: TypeBot: Cross-Workspace Theme Template IDOR (Modification and Deletion)","publisher":{"category":"vendor","name":"HarborGuard Database","namespace":"https://database.harborguard.co"},"tracking":{"id":"CVE-2026-48759","status":"final","version":"1","initial_release_date":"2026-06-17T21:56:35.844Z","current_release_date":"2026-06-17T21:56:35.844Z","revision_history":[{"date":"2026-06-17T21:56:35.844Z","number":"1","summary":"Initial machine-readable export from HarborGuard."}]},"distribution":{"tlp":{"label":"WHITE"},"text":"Public CVE data; freely redistributable."},"notes":[{"category":"description","text":"TypeBot is a chatbot builder tool. Versions 3.15.2 and below have an Insecure Direct Object Reference vulnerability through cross-workspace Theme Template modification and deletion. The handleSaveThemeTemplate and handleDeleteThemeTemplate handlers validate that the authenticated user is a non-guest member of the provided workspaceId, but then operate on themeTemplateId via Prisma queries that do NOT include workspaceId in the WHERE clause. This allows any authenticated user to modify or delete theme templates belonging to any other workspace and may expose Template IDs via shared typebots or network traffic. This issue has been fixed in version 3.16.0.","title":"CVE description"}],"references":[{"category":"self","summary":"CVE-2026-48759 on HarborGuard Database","url":"https://database.harborguard.co/cve/CVE-2026-48759"},{"category":"external","summary":"CVE Record","url":"https://www.cve.org/CVERecord?id=CVE-2026-48759"},{"category":"external","summary":"https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-qv4p-4mp3-pvpv","url":"https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-qv4p-4mp3-pvpv"},{"category":"external","summary":"https://github.com/baptisteArno/typebot.io/releases/tag/v3.16.0","url":"https://github.com/baptisteArno/typebot.io/releases/tag/v3.16.0"}]},"product_tree":{"branches":[{"category":"vendor","name":"baptisteArno","branches":[{"category":"product_name","name":"typebot.io","branches":[{"category":"product_version","name":"< 3.16.0","product":{"name":"baptisteArno typebot.io < 3.16.0","product_id":"CSAFPID-1","product_identification_helper":{"cpe":"cpe:2.3:a:baptistearno:typebot.io:\\<_3.16.0:*:*:*:*:*:*:*"}}}]}]}]},"vulnerabilities":[{"cve":"CVE-2026-48759","title":"TypeBot: Cross-Workspace Theme Template IDOR (Modification and Deletion)","notes":[{"category":"description","text":"TypeBot is a chatbot builder tool. Versions 3.15.2 and below have an Insecure Direct Object Reference vulnerability through cross-workspace Theme Template modification and deletion. The handleSaveThemeTemplate and handleDeleteThemeTemplate handlers validate that the authenticated user is a non-guest member of the provided workspaceId, but then operate on themeTemplateId via Prisma queries that do NOT include workspaceId in the WHERE clause. This allows any authenticated user to modify or delete theme templates belonging to any other workspace and may expose Template IDs via shared typebots or network traffic. This issue has been fixed in version 3.16.0.","title":"CVE description"}],"product_status":{"known_affected":["CSAFPID-1"]},"scores":[{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","baseScore":7.1,"baseSeverity":"HIGH"},"products":["CSAFPID-1"]}],"remediations":[{"category":"none_available","details":"No fixed version is published yet. Monitor the upstream advisory.","product_ids":["CSAFPID-1"]}]}]}