« Volver al listado

CVE-2026-39969

Estado: AplazadaMedia (6.5)—

TypeBot is a chatbot builder tool. In versions 3.16.0 and prior, the WhatsApp Cloud API webhook endpoint (POST /v1/workspaces/{workspaceId}/whatsapp/{credentialsId}/webhook) does not verify the x-hub-signature-256 HMAC signature included by Meta in every webhook delivery. The webhook URL exposes both workspaceId and credentialsId as path parameters, which are logged in web server access logs, visible in Meta's webhook configuration dashboard, and potentially shared when configuring integrations. This allows any unauthenticated attacker to send spoofed webhook messages to trigger bot flows, consume API resources, and interact with external services using the workspace owner's credentials. The issue has been fixed in version 3.17.0.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Typebot — TypebotAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-39969",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-39969",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-23T02:34:58.003512Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "baptisteArno",
          "product": "typebot.io",
          "versions": [
            {
              "status": "affected",
              "version": "< 3.17.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-05-22T19:17:03.500",
  "references": [
    {
      "url": "https://github.com/baptisteArno/typebot.io/releases/tag/v3.17.0",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-8vqp-r5w7-v47f",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-8vqp-r5w7-v47f",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        },
        {
          "lang": "en",
          "value": "CWE-345"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "TypeBot is a chatbot builder tool. In versions 3.16.0 and prior, the WhatsApp Cloud API webhook endpoint (POST /v1/workspaces/{workspaceId}/whatsapp/{credentialsId}/webhook) does not verify the x-hub-signature-256 HMAC signature included by Meta in every webhook delivery. The webhook URL exposes both workspaceId and credentialsId as path parameters, which are logged in web server access logs, visible in Meta's webhook configuration dashboard, and potentially shared when configuring integrations. This allows any unauthenticated attacker to send spoofed webhook messages to trigger bot flows, consume API resources, and interact with external services using the workspace owner's credentials. The issue has been fixed in version 3.17.0."
    },
    {
      "lang": "es",
      "value": "TypeBot es una herramienta de creación de chatbots. En las versiones 3.16.0 y anteriores, el endpoint del webhook de la API de WhatsApp Cloud (POST /v1/workspaces/{workspaceId}/whatsapp/{credentialsId}/webhook) no verifica la firma HMAC x-hub-signature-256 incluida por Meta en cada entrega de webhook. La URL del webhook expone tanto workspaceId como credentialsId como parámetros de ruta, que se registran en los logs de acceso del servidor web, son visibles en el panel de configuración de webhooks de Meta y potencialmente se comparten al configurar integraciones. Esto permite que cualquier atacante no autenticado envíe mensajes de webhook falsificados para activar flujos de bot, consumir recursos de la API e interactuar con servicios externos utilizando las credenciales del propietario del espacio de trabajo. El problema ha sido solucionado en la versión 3.17.0."
    }
  ],
  "lastModified": "2026-07-23T16:10:00.137",
  "sourceIdentifier": "security-advisories@github.com"
}