CVE-2026-105693

Katalog CVE

CVSS 5.3 · Medium EPSS 0,22%

Kerentanan Missing Authorization. Skor CVSS 3.1 5.3 (Medium) menurut github.com.

Deskripsi (NVD)

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the unauthenticated get-view-only-bundle RPC returns every share-link row for a file even when the caller authenticated with only one scoped share link. A holder of a restrictive link can obtain other links' secret IDs, page scopes, comment permissions, and inspection permissions, then replay a more permissive token to access page data that was not included in the original share. This issue is fixed in version 2.18.0.

Rincian

Terbit di NVD

5 Oktober 2026

Terakhir diubah

6 Oktober 2026

Status NVD

Deferred

CVSS 3.1

5.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,22% peluang dieksploitasi; lebih tinggi dari 12,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/penpot/penpot/commit/15195b3bbbbf2911b24007ad42453d264a2774d4
• https://github.com/penpot/penpot/releases/tag/2.18.0
• https://github.com/penpot/penpot/security/advisories/GHSA-w8mf-4x22-24gg