{"@context":"https://openvex.dev/ns/v0.2.0","@id":"https://database.harborguard.co/cve/CVE-2026-48759/vex.json","author":"HarborGuard Database","role":"Document Creator","timestamp":"2026-06-17T21:56:35.844Z","version":1,"tooling":"HarborGuard Database (https://database.harborguard.co)","statements":[{"vulnerability":{"name":"CVE-2026-48759","@id":"https://www.cve.org/CVERecord?id=CVE-2026-48759","description":"TypeBot is a chatbot builder tool. Versions 3.15.2 and below have an Insecure Direct Object Reference vulnerability through cross-workspace Theme Template modification and deletion. The handleSaveThemeTemplate and handleDeleteThemeTemplate handlers validate that the authenticated user is a non-guest member of the provided workspaceId, but then operate on themeTemplateId via Prisma queries that do NOT include workspaceId in the WHERE clause. This allows any authenticated user to modify or delete "},"products":[{"@id":"cpe:2.3:a:baptistearno:typebot.io:\\<_3.16.0:*:*:*:*:*:*:*","identifiers":{"cpe23":"cpe:2.3:a:baptistearno:typebot.io:\\<_3.16.0:*:*:*:*:*:*:*"}}],"status":"affected","action_statement":"No fixed version is published yet; monitor the upstream advisory.","timestamp":"2026-06-17T21:56:35.844Z"}]}