TypeBot, a chatbot builder, includes a backend API endpoint that retrieves Google Sheets OAuth credentials. The component that handles this request fails to confirm that the requester belongs to the workspace whose credentials are being accessed, creating a CWE‑862 Authorization Bypass Without Verification flaw. Consequently an authenticated user can request the data for any workspace they have not joined, receiving the decrypted credentials and basic spreadsheet details. This vulnerability enables a user to read sensitive information and to gain access to external spreadsheets that should be isolated to a specific workspace, thereby compromising confidentiality for all workspaces that are not properly segregated.

The flaw impacts TypeBot (typebot.io) in all installations running a version prior to 3.17.0. Any deployment exposing the POST /api/sheets/getSheets endpoint is affected.

The CVSS score of 7.1 indicates a high severity impact. The EPSS score is below 1 %, indicating a very low probability of industrial‑grade exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited public awareness. However, the attack can be carried out remotely over HTTP by an authenticated user; the attacker only needs valid credentials to a workspace they belong to. Once an exploit succeeds, the attacker obtains OAuth tokens that can be used to access the victim’s Google Sheets data, potentially exposing business information, customer data, and other sensitive content.