CVE-2026-47704: TypeBot vulnerable to cross-typebot webhook resume via unchecked `resultId` lineage allows unauthorized control of another bot's waiting session
TypeBot is a chatbot builder tool. Prior to version 3.17.0, an authenticated user who has read access to any typebot can resume a waiting webhook session that belongs to a different typebot by mixing an authorized typebotId and blockId and a foreign live resultId. The webhook resume handler authorizes the parent typebot first, but then resolves the descendant result only by resultId. As a result, an attacker can inject arbitrary webhook JSON into another typebot's suspended session and advance its execution without any access to the victim typebot. Version 3.17.0 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TypeBotto a version that resolves this vulnerability.Fixed in 3.17.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47704?
CVE-2026-47704 has a risk rating of 55, indicating a moderate level of security concern.
How do I fix CVE-2026-47704?
To fix CVE-2026-47704, upgrade TypeBot to version 3.17.0 or later to ensure that the webhook resume handler performs proper checks on `resultId`.
What does CVE-2026-47704 affect?
CVE-2026-47704 affects TypeBot, specifically its webhook resume functionality that can be exploited by authenticated users.
Who is impacted by CVE-2026-47704?
Any authenticated user with read access to a TypeBot could potentially exploit CVE-2026-47704 to control another bot's waiting session.
When was CVE-2026-47704 published?
CVE-2026-47704 was published on August 11, 2026.