CVE-2026-105692: Penpot Auth Bypass Vulnerability

CVE-2026-105692 Overview

Penpot is an open-source design and prototyping platform used for collaborative UI/UX work. CVE-2026-105692 is a broken access control vulnerability [CWE-284] in the delete-share-link RPC command. Any user with edit permissions on a file can delete share links created by other users if they know the share-link UUID. The flaw affects Penpot versions prior to 2.18.0 and is resolved in 2.18.0.

Critical Impact
File editors can revoke external reviewers' access by deleting share links they did not create, disrupting collaboration workflows and breaking review processes without owner or administrator authorization.

Affected Products

Penpot versions prior to 2.18.0
Self-hosted Penpot deployments
Penpot cloud instances running vulnerable releases

Discovery Timeline

2026-10-05 - CVE-2026-105692 published to the National Vulnerability Database (NVD)
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105692

Vulnerability Analysis

The vulnerability resides in the delete-share-link Remote Procedure Call (RPC) handler within the Penpot backend. The handler accepts a share-link identifier chosen by the caller and performs a single authorization check: whether the caller can edit the parent file. It does not verify that the caller created the share link or holds owner or administrator authority over it.

As a result, any user with file edit permissions can delete share links belonging to other collaborators. This includes links created by file owners, administrators, or external review coordinators. The outcome is unauthorized revocation of external reviewers' access to shared files.

The issue is classified as Improper Access Control [CWE-284]. It stems from a missing ownership predicate on a destructive operation that affects state created by other principals.

Root Cause

The root cause is incomplete authorization logic. The handler conflates "permission to edit the file" with "permission to manage share links on the file." Share-link lifecycle operations require an additional check binding the link's creator or an administrative role to the delete action. The fix adds proper ownership validation in backend/src/app/rpc/commands/files_share.clj.

Attack Vector

Exploitation requires network access to the Penpot API, authenticated access as a file editor, and knowledge of a target share-link UUID. The share-link UUID can be observed through shared editor sessions, project exports, chat messages, or logs. The attacker then invokes the delete-share-link RPC with the target UUID to remove the link.

text

(ns app.rpc.commands.files-share
   "Share link related rpc mutation methods."
   (:require
+   [app.binfile.common :as bfc]
+   [app.common.exceptions :as ex]
    [app.common.schema :as sm]
    [app.common.uuid :as uuid]
    [app.db :as db]

Source: GitHub Commit 209aea83. The patch introduces exception handling and ownership validation imports used to enforce proper authorization on share-link management operations.

Detection Methods for CVE-2026-105692

Indicators of Compromise

Unexpected disappearance of share links previously issued to external reviewers
delete-share-link RPC calls from user accounts other than the share-link creator
Reviewer complaints about sudden loss of access to shared files or prototypes
Audit log entries showing share-link deletions clustered around specific editor accounts

Detection Strategies

Review Penpot backend logs for delete-share-link RPC invocations and correlate the acting user against the stored created-by field of the deleted link
Baseline normal share-link lifecycle activity per project and alert on volume anomalies
Enable database audit logging on the share-links table to capture deletion events with actor identity

Monitoring Recommendations

Forward Penpot application and database logs to a centralized logging or SIEM platform for retention and correlation
Alert on repeated share-link deletions by a single editor across multiple files within a short interval
Monitor API traffic for enumeration patterns against RPC endpoints that accept UUIDs

How to Mitigate CVE-2026-105692

Immediate Actions Required

Upgrade Penpot to version 2.18.0 or later, which contains the ownership check fix
Audit existing share links and recreate any that were deleted without authorization
Review file editor assignments and remove edit permissions from accounts that do not require them

Patch Information

The fix is included in Penpot Release 2.18.0. The code change is tracked in Pull Request #11290 and committed in commit 209aea83. Additional context is available in the GitHub Security Advisory GHSA-8257-pm4f-cfhq.

Workarounds

Restrict file editor roles to trusted users until the upgrade to 2.18.0 is complete
Avoid distributing share-link UUIDs through channels where other editors can observe them
Rotate active share links on a defined schedule to limit the window during which a leaked UUID is usable

bash

# Upgrade self-hosted Penpot via Docker Compose
docker compose pull
docker compose down
docker compose up -d

# Verify the running version is 2.18.0 or later
docker compose exec penpot-backend printenv PENPOT_VERSION