{"data":{"id":"69b630dc-58ef-4f98-bae5-bbfeef8813ba","title":"CVE-2026-48766: TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to exfiltr","summary":"TypeBot, a chatbot builder tool, has a security flaw in versions before 3.17.0 that lets low-privilege guest members steal OpenAI API keys (secret credentials used to access AI services). The vulnerability works because guests can trick the system into sending these secrets to attacker-controlled servers by manipulating a helper tool that lists available AI models.","solution":"Update TypeBot to version 3.17.0, which patches the issue.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-48766","publishedAt":"2026-08-11T16:17:32.320Z","cveId":"CVE-2026-48766","cweIds":["CWE-200"],"cvssScore":"7.6","cvssSeverity":"high","severity":"high","attackType":["data_extraction"],"issueType":"vulnerability","affectedPackages":null,"affectedVendors":["OpenAI"],"affectedVendorsRaw":["TypeBot","OpenAI"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0,"patchAvailable":null,"disclosureDate":"2026-08-11T16:17:32.320Z","capecIds":["CAPEC-116"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null}}