CVE-2026-105696

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-page RPC accepts a share-link permission object with blanket read access but does not verify that the caller-selected page-id belongs to the link's authorized pages set. An attacker with both a valid share link and...

CVE-2026-105696 Penpot: Share-link page-scope escalation: a share-link holder reads pages outside the link's authorized scope via the get-page RPC command

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-page RPC accepts a share-link permission object with blanket read access but does not verify that the caller-selected page-id belongs to the link's authorized pages set. An attacker with both a valid share link and...

EUVD-2026-92715

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-page RPC accepts a share-link permission object with blanket read access but does not verify that the caller-selected page-id belongs to the link's authorized pages set. An attacker with both a valid share link and...

CVE-2026-105696

The Penpot design and prototyping platform is vulnerable to a page-scope escalation in versions prior to 2.18.0 . The get-page and get-file-fragment RPC commands fail to verify if a requested page-id or fragment belongs to the authorized set of a provided share-link permission object. An authenti...

CVE-2026-105696 Penpot: Share-link page-scope escalation: a share-link holder reads pages outside the link's authorized scope via the get-page RPC command

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-page RPC accepts a share-link permission object with blanket read access but does not verify that the caller-selected page-id belongs to the link's authorized pages set. An attacker with both a valid share link and...

CVE-2026-105696: Missing Authorization

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-page RPC accepts a share-link permission object with blanket read access but does not verify that the caller-selected page-id belongs to the link's authorized pages set. An attacker with both a valid share link and...

PT-2026-106217

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.18.0 Description An issue exists where the get-page RPC Remote Procedure Call accepts a share-link permission object providing broad read access but fails to verify if the requested page-id is among the pages...