CVE-2026-44986: Penpot Auth Bypass Vulnerability

CVE-2026-44986 Overview

Penpot, an open-source design and code collaboration tool, contains a critical authentication flaw prior to version 2.14.5. The vulnerability chains three issues in the invitation and registration flow: teams_invitations.clj exposes invitation tokens from create-team-invitations, auth.clj prepare-register-profile embeds an existing profile identifier, and auth.clj register-profile issues a session based solely on invitation email matching without password verification. A registered user can leverage this chain to take over any non-blocked profile in the system. The issue was resolved in Penpot 2.14.5 through changes to invitation token handling in the register process, tracked as GHSA-4937-35vc-hqjj.

Critical Impact
Any authenticated Penpot user can hijack arbitrary non-blocked accounts by abusing exposed invitation tokens, gaining full access to victim profiles and their team resources.

Affected Products

Penpot versions prior to 2.14.5
Penpot self-hosted deployments using the vulnerable authentication module
Penpot team invitation and registration workflow components

Discovery Timeline

2026-07-15 - CVE-2026-44986 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-44986

Vulnerability Analysis

The flaw is an authentication bypass classified under [CWE-287] (Improper Authentication). Penpot's team invitation logic in teams_invitations.clj returns invitation tokens directly from create-team-invitations, making them retrievable by the inviter. These tokens contain claims that the registration path later trusts implicitly.

During registration, auth.clj prepare-register-profile embeds an existing profile identifier into the JWE (JSON Web Encryption) claims when the invitation email matches a registered user. register-profile then issues a valid session for that embedded profile identifier without ever validating a password. The result is that possession of an invitation token targeting a victim's email is sufficient to log in as the victim.

Root Cause

The root cause is misplaced trust in invitation tokens as an authentication factor. The registration flow conflates "email ownership proven by receiving an invitation" with "account ownership proven by password." Because invitation tokens are returned to the inviter rather than being restricted to email delivery, an attacker who invites a victim's email to a team they control obtains a token that yields an authenticated session as the victim.

Attack Vector

An attacker with a registered Penpot account creates a team and invites the target victim's email. The invitation token is returned via the API response from create-team-invitations. The attacker submits that token to the register flow, which recognizes the matching profile identifier embedded by prepare-register-profile and issues a session for the victim's account without password verification.

text

                   {:is-active true}
                   {:id (:id profile)}))
 
+    ;; NOTE: `claims` is returned verbatim (besides :profile). When the
+    ;; verify-email JWE was minted by `register-profile` for a not-yet-
+    ;; active profile that came from an invitation flow, `:invitation-
+    ;; token` will be present here and the frontend will use it to
+    ;; complete the team-invitation flow after login.
     (-> claims
         (rph/with-transform (session/create-fn cfg profile))
         (rph/with-meta {::audit/name "verify-profile-email"

Source: Penpot commit 9e68126 — patch to backend/src/app/rpc/commands/verify_token.clj clarifying and correcting invitation token handling during profile verification.

Detection Methods for CVE-2026-44986

Indicators of Compromise

Team invitation creation events followed by registration or session creation for the invited email from the same source IP or session.
Successful verify-profile-email audit events for profiles that did not initiate registration.
Unexpected profile activations or session issuance without a corresponding password authentication event.
New team memberships added to victim profiles shortly after an invitation was issued by an unfamiliar inviter.

Detection Strategies

Audit Penpot backend logs for create-team-invitations calls whose returned tokens are subsequently consumed by register-profile for profiles that already exist and are active.
Correlate invitation issuance and session creation events by email and time window to identify takeover attempts.
Alert on registration completions where the resulting session belongs to a pre-existing profile identifier rather than a newly created one.

Monitoring Recommendations

Enable and centrally collect Penpot audit logs, focusing on verify-profile-email, register-profile, and invitation RPC events.
Monitor for spikes in team invitations targeting internal or high-value email addresses.
Track session origin metadata (IP, user agent) against historical baselines for privileged Penpot accounts.

How to Mitigate CVE-2026-44986

Immediate Actions Required

Upgrade all Penpot instances to version 2.14.5 or later without delay.
Invalidate active sessions after upgrade and force password rotation for accounts that may have been targeted by suspicious invitations.
Review recent team invitations and membership changes for signs of exploitation, particularly invitations targeting administrator or owner accounts.
Restrict who can create teams and issue invitations in multi-tenant self-hosted deployments until the upgrade is verified.

Patch Information

The fix is available in Penpot Release 2.14.5 and merged via Pull Request 9380. The patch corrects invitation token handling in verify_token.clj and the frontend register flow so that invitation tokens no longer produce sessions for pre-existing profiles without proper verification. Full technical details are documented in GHSA-4937-35vc-hqjj.

Workarounds

No official workaround exists short of upgrading to 2.14.5.
As a temporary compensating control, disable team invitations at the reverse proxy or application layer until the upgrade is applied.
Restrict network access to the Penpot instance to trusted users only, reducing the pool of accounts that can trigger the invitation flow.

bash

# Upgrade Penpot to the patched release using Docker Compose
docker compose pull
docker compose down
# Pin the patched tag in docker-compose.yaml: image: penpotapp/backend:2.14.5
docker compose up -d

# Verify the running backend version
docker exec -it penpot-backend cat /opt/penpot/backend/version.txt