CVE-2026-62861

UNKNOWN 0.0

TypeBot: Cross-tenant custom-domain removal via unbound `name` in handleDeleteCustomDomain

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

TypeBot is a chatbot builder tool. Prior to 3.18.0, any authenticated non-guest workspace member can remove another workspace's public custom domain and make typebots on that domain unavailable. The custom-domain delete handler in handleDeleteCustomDomain.ts authorizes a caller against a client-supplied workspaceId but sends the client-supplied domain name to the shared Vercel project before verifying that the domain belongs to that workspace. This issue is fixed in version 3.18.0.

CWE	CWE-639 CWE-862
Vendor	baptistearno
Product	typebot.io
Published	Aug 25, 2026

Stay Ahead of the Next One

Get instant alerts for baptistearno typebot.io

Be the first to know when new unknown vulnerabilities affecting baptistearno typebot.io are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

baptisteArno / typebot.io

< 3.18.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-7h82-p425-wpmg github.com: https://github.com/baptisteArno/typebot.io/commit/06575dfcd461ba76071012869d4b1f4046f9a6b8 github.com: https://github.com/baptisteArno/typebot.io/releases/tag/v3.18.0