CyberRota Analysis
AI-GeneratedAuthenticated non-guest members of a TypeBot workspace prior to version 3.18.0 can exploit a flaw in the custom domain deletion process to remove public custom domains from other workspaces, rendering associated typebots unavailable. This vulnerability poses a medium risk, as it can disrupt services for affected workspaces and potentially lead to unauthorized domain manipulation. Organizations using TypeBot should prioritize updating to version 3.18.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
TypeBot is a chatbot builder tool. Prior to 3.18.0, any authenticated non-guest workspace member can remove another workspace's public custom domain and make typebots on that domain unavailable. The custom-domain delete handler in handleDeleteCustomDomain.ts authorizes a caller against a client-supplied workspaceId but sends the client-supplied domain name to the shared Vercel project before verifying that the domain belongs to that workspace. This issue is fixed in version 3.18.0.