Skip to main content
Stopping PHP2SHELL: How SentinelOne Protects Customers From This Attack TechniqueRead More
Vulnerability Database/CVE-2026-105696

CVE-2026-105696: Penpot Authentication Bypass Vulnerability

CVE-2026-105696 is an authentication bypass flaw in Penpot that allows attackers to access unauthorized page data through share links. This post explains its impact, affected versions, and mitigation steps.

Published:

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Sources: National Vulnerability Database, CISA KEV, Exploit-DB

CVE-2026-105696 Overview

Penpot, an open-source design and prototyping platform, contains a missing authorization flaw [CWE-862] in its get-page and get-file-fragment Remote Procedure Call (RPC) handlers. Versions prior to 2.18.0 accept a share-link permission object granting blanket read access without verifying that the caller-supplied page-id belongs to the link's authorized pages set. An authenticated attacker holding a valid share link to one page can retrieve the full shape and design data of other pages in the same file when their identifiers are known. The related get-file-fragment RPC exhibits the same scope-check omission for file fragments. Penpot fixed the issue in version 2.18.0.

Critical Impact

Authenticated holders of a limited share link can read design data for non-shared pages in the same Penpot file, exposing confidential project content.

Affected Products

  • Penpot versions prior to 2.18.0
  • get-page RPC command in backend/src/app/rpc/commands/files.clj
  • get-file-fragment RPC command in backend/src/app/rpc/commands/files.clj

Discovery Timeline

  • 2026-10-05 - CVE-2026-105696 published to the National Vulnerability Database (NVD)
  • 2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105696

Vulnerability Analysis

Penpot share links allow a file owner to expose a specific subset of pages for external viewing. The get-page RPC command is marked as requiring authentication, so Penpot treats it as a privileged read path. However, when the caller presents a share-link permission object, the handler trusts the object's read scope and services whatever page-id the client supplies. The handler does not intersect the requested page-id with the pages explicitly whitelisted in the share link.

An attacker who possesses a legitimate share link to one page in a file, plus their own authenticated Penpot session, can enumerate or guess sibling page-id values and request those pages through get-page. The server returns the complete shape, layer, and design payload. The get-file-fragment RPC exhibits parallel behavior: share-link callers receive fragments without any check that the fragment belongs to an authorized page.

Root Cause

The root cause is a missing authorization check that constrains share-link callers to the link's authorized pages set. The permissions object was treated as a sufficient capability for file-level reads instead of being scoped to specific page identifiers. This is a classic broken access control pattern [CWE-862] where the resource identifier supplied by the client is not validated against the caller's actual grant.

Attack Vector

Exploitation requires network access to a Penpot instance, an authenticated attacker account, and a valid share link to any page within the target file. The attacker also needs the target page-id or fragment-id, which can be obtained through prior access, enumeration of UUID patterns in referenced resources, or leakage via collaborator channels. No user interaction from the victim is required.

clojure
;; Patch excerpt from backend/src/app/rpc/commands/files.clj
;; Enforces that share-link callers cannot reach get-file-fragment
[cfg {:keys [::rpc/profile-id file-id fragment-id share-id]}]
(db/run! cfg (fn [cfg]
               (let [perms (perms/get-file-read-permissions cfg profile-id file-id share-id)]
                 (when (= :share-link (:type perms))
                   (ex/raise :type :not-found
                             :code :object-not-found
                             :hint "object not found"))
                 (check-read-permissions! perms)
                 (-> (get-file-fragment cfg file-id fragment-id)
                     (rph/with-http-cache long-cache-duration))))))

Source: Penpot commit 52573be

Detect Identity Attacks the Moment Authentication Fails

Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.

Stop Identity Attacks

Detection Methods for CVE-2026-105696

Indicators of Compromise

  • Repeated get-page RPC calls from a single authenticated session targeting multiple page-id values within the same file-id.
  • get-file-fragment requests originating from sessions whose permission type resolves to share-link.
  • Access patterns where the requested page-id does not match any identifier in the share link's authorized pages set.

Detection Strategies

  • Correlate Penpot application logs with session identifiers to flag share-link sessions issuing RPCs for page-id values outside the link's declared scope.
  • Baseline typical share-link viewer behavior (single page, bounded fragment count) and alert on deviations.
  • Review audit records for enumeration bursts against the get-page and get-file-fragment endpoints.

Monitoring Recommendations

  • Forward Penpot backend RPC logs to a centralized log platform and retain profile-id, share-id, file-id, and page-id fields.
  • Alert on HTTP 200 responses from get-file-fragment where the caller's permission type is share-link after upgrading, as the patch should return object-not-found.
  • Monitor outbound bandwidth from the Penpot backend for anomalous payload sizes tied to share-link sessions.

How to Mitigate CVE-2026-105696

Immediate Actions Required

  • Upgrade all Penpot instances to version 2.18.0 or later, which enforces share-link page scope in both affected RPCs.
  • Rotate or revoke existing share links for files containing sensitive pages that may have been exposed to share-link holders.
  • Audit recent get-page and get-file-fragment activity to identify potential cross-page access by share-link callers.

Patch Information

The fix is delivered in Penpot 2.18.0 via commit 52573be07472987703b2ce715c4c10919f4e153e. The patch rejects get-file-fragment requests from share-link callers with :object-not-found and constrains get-page to the share link's authorized pages set. See the Penpot 2.18.0 release notes and the GHSA-x9xg-qphx-8grr advisory for full details.

Workarounds

  • Disable share links for files containing confidential or non-public pages until the upgrade is applied.
  • Restrict Penpot account registration to trusted users, since exploitation requires an authenticated attacker session.
  • Place the Penpot backend behind a reverse proxy that rate-limits get-page and get-file-fragment RPC calls to curb enumeration.
bash
# Verify the running Penpot backend version after upgrade
docker exec -it penpot-backend sh -c 'cat /opt/penpot/backend/version.txt'

# Expected output should be 2.18.0 or later

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Sources: National Vulnerability Database, CISA KEV, Exploit-DB

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne