8 matches found
CVE-2026-105693
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the unauthenticated get-view-only-bundle RPC returns every share-link row for a file even when the caller authenticated with only one scoped share link. A holder of a restrictive link can obtain other links' secret IDs, pa...
CVE-2026-105693 Penpot: Anonymous share-link token disclosure & page-scope bypass via get-view-only-bundle
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the unauthenticated get-view-only-bundle RPC returns every share-link row for a file even when the caller authenticated with only one scoped share link. A holder of a restrictive link can obtain other links' secret IDs, pa...
CVE-2026-105693 Penpot: Anonymous share-link token disclosure & page-scope bypass via get-view-only-bundle
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the unauthenticated get-view-only-bundle RPC returns every share-link row for a file even when the caller authenticated with only one scoped share link. A holder of a restrictive link can obtain other links' secret IDs, pa...
CVE-2026-105693
The open-source design and prototyping platform Penpot is vulnerable to an anonymous share-link token disclosure and page-scope bypass in versions prior to 2.18.0 . The unauthenticated get-view-only-bundle RPC incorrectly returns every share-link row for a file, even when a caller authenticates w...
EUVD-2026-92712
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the unauthenticated get-view-only-bundle RPC returns every share-link row for a file even when the caller authenticated with only one scoped share link. A holder of a restrictive link can obtain other links' secret IDs, pa...
CVE-2026-105693 Penpot: Anonymous share-link token disclosure & page-scope bypass via get-view-only-bundle
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the unauthenticated get-view-only-bundle RPC returns every share-link row for a file even when the caller authenticated with only one scoped share link. A holder of a restrictive link can obtain other links' secret IDs, pa...
PT-2026-106214
Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.18.0 Description An issue exists in the unauthenticated get-view-only-bundle RPC Remote Procedure Call that returns all share-link rows for a file, regardless of whether the caller authenticated with a single scoped...
CVE-2026-105693: Missing Authorization
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the unauthenticated get-view-only-bundle RPC returns every share-link row for a file even when the caller authenticated with only one scoped share link. A holder of a restrictive link can obtain other links' secret IDs, pa...