CVE-2026-113596

Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user's project UUID can query the /trpc handler to retrieve publish...

EUVD-2026-105162

Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user's project UUID can query the /trpc handler to retrieve publish...

CVE-2026-113596

Webstudio versions prior to 0.256.0 are vulnerable to an information disclosure flaw caused by missing authorization in the tRPC procedures publishedBuilds and findManyByIds. Authenticated users who possess another user's project UUID can query the /trpc handler to retrieve sensitive project data...