CVE-2026-105696

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-105696
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105696.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-105696
Aliases
  • GHSA-x9xg-qphx-8grr
Published
2026-10-05T20:05:30Z
Modified
2026-10-07T02:47:33Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Penpot: Share-link page-scope escalation: a share-link holder reads pages outside the link's authorized scope via the get-page RPC command
Details

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-page RPC accepts a share-link permission object with blanket read access but does not verify that the caller-selected page-id belongs to the link's authorized pages set. An attacker with both a valid share link and the attacker's own authenticated Penpot session can retrieve the complete shape and design data of another page in the same file when its identifier is known, because get-page requires authentication. The related get-file-fragment RPC also permits share-link access without mapping fragments to authorized pages. This issue is fixed in version 2.18.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105696.json"
}
References

Affected packages

Git / github.com/penpot/penpot

Affected ranges

Type
GIT
Repo
https://github.com/penpot/penpot
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
52573be07472987703b2ce715c4c10919f4e153e
Fixed
5baffdc213f0deaaeb318e97a41d611ac0656a94
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.18.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.0.0
0.1.0
1.*
1.0.0-alpha
1.1.0-alpha
1.14.0-beta
1.14.1-beta
1.2.0-alpha
1.3.0-alpha
1.4.0-alpha
1.4.0-dev
1.4.1-alpha
1.5.0-alpha
1.5.1-alpha
1.5.2-alpha
1.5.3-alpha
1.5.4-alpha
1.6.0-alpha
1.6.1-alpha
1.6.2-alpha
1.6.3-alpha
1.6.4-alpha
1.6.5-alpha
1.7.0-alpha
1.7.1-alpha
1.7.2-alpha
1.7.3-alpha
1.7.4-alpha
1.8.0-alpha
1.8.1-alpha
1.8.2-alpha
1.9.0-alpha
2.*
2.10.0-RC1
2.14.0-RC1
2.14.0-RC2
2.14.0-RC3
2.14.0-RC4
2.15.0-RC1
2.16.0
2.16.0-RC1
2.16.0-RC11
2.16.0-RC13
2.16.0-RC2
2.16.0-RC3
2.16.0-RC4
2.16.0-RC5
2.16.0-RC6
2.16.0-RC7
2.16.0-RC8
2.16.0-RC9
2.16.1-RC2
2.17.0
2.17.0-RC1
2.17.0-RC3
2.17.0-RC4
2.17.0-RC5
2.17.0-RC6
2.17.1-RC1
2.17.1-RC2
2.17.1-RC3
2.17.1-RC4
2.17.1-RC5
2.18.0-RC1
2.18.0-RC2
2.18.0-RC3
2.18.0-RC4
2.18.0-RC6
2.18.0-RC7
2.5.0-DEV
2.5.0-RC1
2.6.0-RC1
2.7.0-RC1
Other
pre-lazy-loading

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105696.json"