CVE-2026-105688 Penpot: Team admin can escalate to owner via team invitation (missing owner-role guard on the invitation path)

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, create-team-invitations and the invitation acceptance path allow a non-owner team administrator to assign the owner role because invitation roles are persisted and applied without the role-ceiling check used by...

CVE-2026-105688

The open-source design and prototyping platform Penpot is vulnerable to privilege escalation prior to version 2.18.0 . The root cause is a missing owner-role guard on the create-team-invitations and invitation acceptance paths. Because invitation roles are persisted without the role-ceiling check...

CVE-2026-105688: Improper Privilege Management

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, create-team-invitations and the invitation acceptance path allow a non-owner team administrator to assign the owner role because invitation roles are persisted and applied without the role-ceiling check used by...

CVE-2026-44986: Improper Authentication

Penpot is an open-source design tool for design and code collaboration. Prior to 2.14.5, Penpot exposed teamsinvitations.clj invitation tokens from create-team-invitations, embedded an existing profile id in auth.clj prepare-register-profile, and had auth.clj register-profile issue a session base...