CVE-2026-105693 | BDVDB-2026-383012 Detail

Description#

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the unauthenticated get-view-only-bundle RPC returns every share-link row for a file even when the caller authenticated with only one scoped share link. A holder of a restrictive link can obtain other links' secret IDs, page scopes, comment permissions, and inspection permissions, then replay a more permissive token to access page data that was not included in the original share. This issue is fixed in version 2.18.0.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-10-05Record published in the CVE List.
2. Version 22026-10-06Most recent update recorded in the CVE List.