Typebot.io, a chatbot builder, contains a flaw in its bot engine where the query that retrieves result data is not properly filtered by the typebotId. This oversight allows an authenticated user to request the data of another typebot by supplying a foreign resultId to the startChat endpoint, thereby accessing that bot's answers, variable values, and certain session flags. The vulnerability can expose personally identifying information such as names, emails and phone numbers from previous user sessions.

The flaw affects all installations of Typebot.io version 3.15.2 and earlier. The affected vendor is baptisteArno:typebot.io. To reach the impacted code, the attacker must use the startChat API endpoint on a logged‑in account. Upgrading to the released version 3.16.0 removes the missing filter and protects the data.

The CVSS score of 3.1 reflects a low severity due to the authentication requirement. Because the exploit depends on a cryptographically random 24‑character CUID2 token and the requirement for matching variable names, brute‑force attempts are infeasible, and the opportunity window is narrow. Although the EPSS score is currently unavailable, the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation has been reported yet. Nonetheless, if an authenticated user can target another bot, they could read PII and session state, presenting a data confidentiality risk.