CVE-2026-48494

The vulnerability in TypeBot through 3.16.x isn't a missing authorization check — it's a namespace collision between the typebot authorization model and WhatsApp's phone-number-based session model. The handler correctly validates that the requester can access the parent typebot, but the session that gets resolved and manipulated is determined by a phone number that can belong to a completely different typebot in a different workspace. The authorization gate and session resolution gate are checking different objects, creating a classic confused deputy scenario where trust in the authorized parent bleeds over into trusting operations on a session it doesn't own. This targets preview sessions specifically — the ephemeral webhooks developers use to test unpublished typebots. The gain isn't direct data exfiltration; it's the ability to inject arbitrary webhook JSON into another workspace's draft flow and observe how it responds. This can expose unpublished logic, credential configurations within flow steps (API keys, internal endpoints), or trigger the victim's own integrations to harvest responses. The CVSS 3.1 score of 7.1 appears conservative given the cross-workspace scope and active manipulation of unpublished workflows — the real risk scales with how tightly preview workflows mirror production integrations, which by design is the point of the preview system. The 3.17.0 patch likely added a runtime ownership assertion rather than restructuring session storage — the session lookup by phone number now verifies the resolved session belongs to the authorized typebot. This suggests the fix was targeted rather than architectural, which means similar phone-number-based lookups may exist elsewhere in the codebase. Audit other webhook handlers that resolve sessions or state by single identifiers without cross-referencing the authorized parent object. More broadly, treat preview environments as having the same attack surface as production: developers routinely wire preview typebots to production-adjacent services (payment credentials, internal APIs, staging endpoints), making the preview-to-downstream pivot a genuine exploitation vector.

Reviewed through automated stages and approved by a human before publication.