CVE-2026-48759
TypeBot is a chatbot builder tool. Versions 3.15.2 and below have an Insecure Direct Object Reference vulnerability through cross-workspace Theme Template modification and deletion. The handleSaveThemeTemplate and handleDeleteThemeTemplate handlers validate that the authenticated user is a non-guest member of the provided workspaceId, but then operate on themeTemplateId via Prisma queries that do NOT include workspaceId in the WHERE clause. This allows any authenticated user to modify or delete theme templates belonging to any other workspace and may expose Template IDs via shared typebots or network traffic. This issue has been fixed in version 3.16.0.
- CVSS 3.1
- 7.1 HIGH
- EPSS
- 0.2% (10th percentile)
- Weakness
- CWE-639
- NVD status
- Deferred
- Published
- 2026-06-17
No indexed exploits for CVE-2026-48759 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-48759 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.