CVE-2025-39967 Typebot Broken Access Control: Unauthorized Access to Other Typebot Results via Missing typebotId Filter

Vulnerability Summary: Cross-Typebot Result Data Access via Missing typebotId Filter Vulnerability Overview Vulnerability Name: Cross-Typebot Result Data Access via Missing typebotId Filter CVE ID: CVE-2025-39967 Severity: Low (CVSS 3.1 Base Score: 3.1) Affected Versions: <= 3.15.2 Fixed Version: 3.16.0 Description: The query in Typebot does not filter by when retrieving results, allowing authenticated users to load result data (user answers, variable values, etc.) from other typebots by providing an external . While actual exploitation is limited by the unpredictability of CUID2-formatted result IDs, this represents a missing authorization check that violates the principle of least privilege. Impact Scope Attack Vector: Network Attack Complexity: High Privileges Required: Low - Any authenticated user (for preview) or no privileges (for live bots) User Interaction: None Scope: Unchanged - Within Typebot boundaries Confidentiality: Low - Exposes previous user answers and variable values Integrity: None - Read-only access Availability: None - No availability impact Information Exposure If successfully exploited, an attacker can read: All previous answers submitted by the original user All variable values set during the original session The flag This data may include Personally Identifiable Information (PII) such as names, emails, phone numbers, and other form inputs Practical Limitations 1. CUID2 Format: Result IDs are generated using CUID2, producing cryptographically random 24-character strings (e.g., ), making brute-force infeasible 2. rememberUser Must Be Enabled: The call only occurs when the typebot's setting is active 3. Variable Mapping: Loaded variables are only useful if the current typebot has matching variable names Remediation Add a filter to the query and pass from the calling context. Fix Code File: packages/bot-engine/src/queries/findResult.ts File: packages/bot-engine/src/api/handleStartChat.ts POC Code If the target typebot has enabled and the is valid, the response will contain variables prefilled from the external result.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-39967 Typebot Broken Access Control: Unauthorized Access to Other Typebot Results via Missing typebotId Filter

More from this source