A low‑privilege read collaborator on a TypeBot workspace can read a bot configuration to obtain an OAuth credentialsId and then call handleUpdateOAuthCredentials( ) with an attacker‑specified workspaceId. The endpoint validates only the supplied workspace and updates the credential record globally by its id, also rewritting the credential’s workspaceId. This allows the attacker to overwrite the credential in a different workspace and reassign it, thereby gaining access to that workspace’s OAuth tokens. The vulnerability is a classic example of weak ownership validation (CWE‑639) and can result in the compromise of confidential data and services that use the stolen OAuth credentials.

The issue affects all releases of TypeBot by baptisteArno before version 3.17.0. Version 3.17.0 incorporates the fix; earlier versions remain vulnerable.

With a CVSS score of 9.9, this flaw is considered critical. The EPSS score of less than 1% indicates a low probability of exploitation in the wild, and it is not listed in the CISA KEV catalog. The attack requires that the adversary already have read‑access to a workspace, so it is an in‑system privilege escalation rather than a remote exploit. Nevertheless, the potential impact is high, and the lack of robust ownership checks makes it a risky flaw for any TypeBot deployment that employs collaborative workspaces.