CyberRota Analysis
AI-GeneratedThe vulnerability in TypeBot allows authenticated users to exploit the `handleGetSheets` API handler to access and decrypt Google Sheets OAuth credentials from other workspaces, compromising sensitive spreadsheet data. This poses a significant risk to data confidentiality and integrity, making it critical for organizations using versions prior to 3.17.0 to prioritize immediate updates to mitigate potential data breaches. All users of the chatbot builder tool should assess their exposure and implement the necessary patch.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
TypeBot is a chatbot builder tool. Prior to version 3.17.0, the `handleGetSheets` API handler (`POST /api/sheets/getSheets`) does not validate workspace membership, allowing any authenticated user to access and decrypt another workspace's Google Sheets OAuth credentials and retrieve spreadsheet data (sheet names, IDs, column headers). Version 3.17.0 fixes the issue.