CVE-2026-105687

4.9 Moyenne

Publiée le 05/10/2026 à 22:17 · Modifiée le 06/10/2026 à 17:17 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team administrator to remove any member other than themselves but does not protect the team owner. A non-owner administrator can delete the owner's team-profile-rel membership and lock the owner out of the team and its projects, files, fonts, and media. This issue is fixed in version 2.18.0.

Traduire en français

Produits concernés

penpot

Scores CVSS

Version	Score	Source	Vecteur
3.1	4.9 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H`

Faiblesses (CWE)

CWE-269
CWE-863

Références

https://github.com/penpot/penpot/commit/45f0153e8fb1d9b70f2cb121b15780ba2c2085c4
https://github.com/penpot/penpot/releases/tag/2.18.0
https://github.com/penpot/penpot/security/advisories/GHSA-j83r-hph3-xpxc

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories