CyberRota Analysis
AI-GeneratedIn TypeBot version 3.16.1, an authenticated user with read access can exploit a vulnerability to manipulate WhatsApp preview webhook sessions belonging to different typebots by mixing authorized identifiers with foreign phone numbers. This allows an attacker to inject arbitrary JSON into another workspace's session, potentially advancing unpublished flows without authorization. Organizations using this version should prioritize updating to version 3.17.0 to mitigate the risk of unauthorized access and data manipulation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
TypeBot is a chatbot builder tool. In version 3.16.1, an authenticated user who has read access to any typebot can resume a WhatsApp preview webhook session that belongs to a different typebot by mixing an authorized `typebotId` and `blockId` and a foreign preview phone number tied to another preview session. The WhatsApp test-webhook handler authorizes the parent typebot first, but then resolves the preview chat session only by `wa-preview-{phone}`. As a result, an attacker can inject arbitrary webhook JSON into another workspace's WhatsApp preview session and advance its draft/unpublished flow without any access to the victim typebot. Version 3.17.0 patches the issue.