CVE-2026-105693: Penpot Auth Bypass Vulnerability

CVE-2026-105693 Overview

Penpot is an open-source design and prototyping platform. CVE-2026-105693 is an authorization flaw in the unauthenticated get-view-only-bundle RPC endpoint. The endpoint returns every share-link row associated with a file, even when the caller authenticated with only a single scoped share link. A holder of a restrictive share link can read other links' secret IDs, page scopes, comment permissions, and inspection permissions. The attacker can then replay a more permissive token to view page data outside their original share scope. The issue affects Penpot releases prior to 2.18.0 and is tracked under [CWE-862: Missing Authorization].

Critical Impact

An attacker with any valid share link to a Penpot file can enumerate and reuse sibling share tokens to access additional pages, comments, and inspection data not intended to be shared with them.

Affected Products

• Penpot versions prior to 2.18.0
• Self-hosted Penpot deployments exposing the viewer RPC
• Penpot cloud instances running affected releases

Discovery Timeline

• 2026-10-05 - CVE-2026-105693 published to NVD
• 2026-10-06 - Last updated in NVD database
• Fixed in - Penpot 2.18.0 via commit 15195b3bbbbf2911b24007ad42453d264a2774d4

Technical Details for CVE-2026-105693

Vulnerability Analysis

The vulnerability resides in the get-view-only-bundle RPC handler in backend/src/app/rpc/commands/viewer.clj. The handler loads a file and attaches share-link metadata to the response. The pre-patch implementation returned the full share-link collection for the file regardless of which share token the caller presented. A caller holding one restrictive link received the complete list of sibling share-link records in the response payload, including their secret IDs and permission scopes.

Once an attacker extracts a more permissive secret ID, they can replay that token against the viewer endpoint. The replayed request is treated as a legitimate access to the broader scope defined by the stolen link. This bypasses the compartmentalization that scoped share links are designed to enforce.

Root Cause

The RPC command did not filter share-link rows by the share-id presented by the caller. The query returned all share links tied to the file identifier, treating authorization at the file level rather than the link level. This is a classic missing authorization check [CWE-862], where object-level access control is absent from a response-building function.

Attack Vector

Exploitation requires network access to the Penpot backend and possession of any single valid share link for the target file. The attacker calls the unauthenticated get-view-only-bundle RPC with their restrictive token, parses sibling share-link entries from the response, and reissues the RPC using the most permissive token discovered. No user interaction, elevated privileges, or local access is required.

       (assoc :can-read true)))
 
 (defn- get-view-only-bundle
-  [{:keys [::db/conn] :as cfg} {:keys [profile-id file-id ::perms] :as params}]
+  [{:keys [::db/conn] :as cfg} {:keys [profile-id file-id share-id ::perms] :as params}]
   (let [file    (bfc/get-file cfg file-id)
 
         project (db/get conn :project

Source: GitHub commit 15195b3. The patch threads share-id into the handler so share-link rows can be filtered to the specific token presented by the caller.

Detection Methods for CVE-2026-105693

Indicators of Compromise

• Repeated get-view-only-bundle RPC calls against the same file-id using different share-id values from the same source IP or session
• Viewer sessions that present a share token not previously issued through normal link-sharing workflows
• Access to file pages or comments that fall outside the scope of the share token originally sent to a known recipient

Detection Strategies

• Instrument the get-view-only-bundle RPC with request/response logging that records both the inbound share-id and the share-link IDs returned to the client
• Alert when a single client enumerates multiple sibling share tokens for one file within a short interval
• Correlate viewer-access logs with the share-link issuance table to flag tokens accessed by parties who were never emailed the link

Monitoring Recommendations

• Forward Penpot backend application logs and HTTP access logs into a centralized log platform for retention and correlation
• Baseline normal viewer traffic per file and alert on spikes in unique share-id values observed from a single caller
• Review audit trails for any viewer sessions that preceded the upgrade to 2.18.0 to identify potential pre-patch disclosure

How to Mitigate CVE-2026-105693

Immediate Actions Required

• Upgrade all Penpot deployments to version 2.18.0 or later without delay
• Rotate every active share link on files that may have been accessed by untrusted parties prior to upgrading
• Audit viewer RPC logs for anomalous enumeration of share tokens against sensitive design files

Patch Information

The fix is delivered in Penpot 2.18.0. The commit 15195b3 modifies get-view-only-bundle to accept the caller's share-id and filter the returned share-link collection accordingly. See the GitHub Security Advisory GHSA-w8mf-4x22-24gg and the Penpot 2.18.0 release notes for complete details.

Workarounds

• Where immediate upgrade is not possible, revoke share links on files containing sensitive content and distribute access via authenticated accounts instead
• Restrict network reachability of the Penpot backend to trusted collaborators until the patched release is deployed
• Avoid issuing multiple scoped share links for the same file to mutually untrusted recipients prior to patching

# Upgrade Penpot self-hosted deployment using docker-compose
git fetch --tags
git checkout 2.18.0
docker compose pull
docker compose up -d

# Verify running version
docker compose exec penpot-backend cat /opt/penpot/backend/version.txt