CVE-2026-105693

5.3 Moyenne

Publiée le 05/10/2026 à 22:17 · Modifiée le 06/10/2026 à 16:17 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the unauthenticated get-view-only-bundle RPC returns every share-link row for a file even when the caller authenticated with only one scoped share link. A holder of a restrictive link can obtain other links' secret IDs, page scopes, comment permissions, and inspection permissions, then replay a more permissive token to access page data that was not included in the original share. This issue is fixed in version 2.18.0.

Traduire en français

Produits concernés

penpot

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.3 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N`

Faiblesses (CWE)

CWE-862

Références

https://github.com/penpot/penpot/commit/15195b3bbbbf2911b24007ad42453d264a2774d4
https://github.com/penpot/penpot/releases/tag/2.18.0
https://github.com/penpot/penpot/security/advisories/GHSA-w8mf-4x22-24gg
https://github.com/penpot/penpot/security/advisories/GHSA-w8mf-4x22-24gg

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories