CVE-2026-62861

MediumCVSS 6.4/10Last modified Sep 9, 2026

Description

TypeBot is a chatbot builder tool. Prior to 3.18.0, any authenticated non-guest workspace member can remove another workspace's public custom domain and make typebots on that domain unavailable. The custom-domain delete handler in handleDeleteCustomDomain.ts authorizes a caller against a client-supplied workspaceId but sends the client-supplied domain name to the shared Vercel project before verifying that the domain belongs to that workspace. This issue is fixed in version 3.18.0.

Metrics

CVSS 4.0 6.4/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-639 CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Aug 25, 2026
Last modified: Sep 9, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-628629.1Typebot is an open-source chatbot builder. In self-hosted versions up to and including 3.17.1, the default passwordless email magic-link aut CVE-2026-628658.7Typebot is an open-source chatbot builder. In self-hosted versions prior to 3.18.0, the server-side Send Email integration block allows arbi CVE-2026-628666.2Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/CVE-2026-628679.9Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided `block.create_options`CVE-2026-628698.8Insufficient verification of data authenticity in Azure Entra ID allows an authorized attacker to perform spoofing over a network.CVE-2026-62875.4The ShopLentor - WooCommerce Builder for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bl CVE-2026-628708.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-628717.8Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.CVE-2026-628728.8Incorrect authorization in .NET Framework allows an authorized attacker to elevate privileges over a network.CVE-2026-628739.8Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a CVE-2026-628749.8Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to elevate privileges over a network.CVE-2026-628767.8Out-of-bounds read in Windows Win32K allows an authorized attacker to elevate privileges locally.