EEF-CVE-2026-47068
- Source
- https://cna.erlef.org/osv/EEF-CVE-2026-47068.html
- Import Source
- https://cna.erlef.org/osv/EEF-CVE-2026-47068.json
- JSON Data
- https://api.osv.dev/v1/vulns/EEF-CVE-2026-47068
- Aliases
-
- CVE-2026-47068
- GHSA-mrhx-6pw9-q5fh
- Published
- 2026-05-20T13:35:33.215Z
- Modified
- 2026-05-20T13:56:23.111680394Z
- Severity
-
- 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Cross-session PubSub topic injection via URL parameter in phoenix_storybook
- Details
-
Summary
Authorization Bypass Through User-Controlled Key vulnerability in phenixdigital phoenix_storybook allows cross-session PubSub topic injection via a URL query parameter.
'Elixir.PhoenixStorybook.Story.ComponentIframeLive':handleparams/3 in lib/phoenixstorybook/live/story/componentiframelive.ex reads a PubSub topic directly from params["topic"] and broadcasts {:componentiframepid, self()} on it with no check that the topic belongs to the requesting session. The shared PhoenixStorybook.PubSub is used to coordinate playground LiveViews with their iframes: a playground subscribes to a session-specific topic and uses the received iframe pid to direct subsequent control messages (variation state, theme switches, extra-assign payloads) via send/2. Because the iframe trusts the query parameter, an attacker who loads /storybook/iframe/<story>?topic=<victim_topic> causes their iframe process pid to be announced on the victim's topic. The victim's playground then addresses its private messages to the attacker's iframe process.
This issue affects phoenix_storybook from 0.4.0 before 1.1.0.
- Database specific
{ "cwe_ids": [ "CWE-639" ], "capec_ids": [ "CAPEC-12" ], "cpe_ids": [ "cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*" ] }- References
- Credits
-
-
- Peter Ullrich - FINDER
-
- Christian Blavier - REMEDIATION_DEVELOPER
-
- Jonatan Männchen - ANALYST
-
Affected packages
Hex / phoenix_storybook
Package
- Name
- phoenix_storybook
- Purl
- pkg:hex/phoenix_storybook