CVE-2026-47704

CVE-2026-47704 is an authorization bypass in TypeBot's webhook resume handler where the system validates access against typebotId and blockId, then discards that context entirely when resolving the session via resultId. The authorization check and the execution operate on different entities with no reconciliation—an IDOR pattern wearing microservices clothing. The 7.1 CVSS likely understates the actual risk: the vulnerability lets an attacker inject JSON that advances a victim's suspended session, which then fires webhooks to external services using the victim's IP reputation and authentication context. The victim's flow becomes a weapon against third-party systems that trust the webhook source—CRM updates, ticket creation, or payment processing if the flow supports those integrations. This isn't just data integrity; it's trust inheritance through a compromised intermediary. The patch in version 3.17.0 fixes this specific instance, but the underlying pattern—authorizing against entity A while operating on entity B—likely exists elsewhere in the codebase. The webhook resume path appears to be legacy code that predates the current authorization model, making it a forgotten surface that escaped prior security hardening cycles. Audit your deployment for other cross-module identifier compositions where neither module validates the other's context. More critically, review what your webhook destinations do with incoming state—those downstream integrations are where the actual blast radius accumulates, and they're rarely revisited during patch cycles.

Reviewed through automated stages and approved by a human before publication.