Penpot CVE-2026-105687

Attacker must hold an active non-owner team administrator role on a Penpot team that has a distinct owner, and the team must run a version prior to 2.18.0. The attack uses the standard delete-team-member RPC against default configurations - no special feature toggle is needed - but exploitation is bounded by three factors: (1) attacker already needs admin-level authentication on the target team (PR:H, not remote-unauthenticated); (2) impact is limited to availability/lockout of the targeted owner, with no confidentiality or integrity effect; (3) upgrading to 2.18.0, which rejects owner removal by non-owners with :cant-remove-owner, fully mitigates it.

This is a genuine but limited-severity authorization flaw (CWE-269, improper privilege management), not a high-urgency network threat. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H, base 4.9/Medium) is internally consistent with the description: exploitation is over the network via the delete-team-member RPC with low complexity, but requires PR:H - the attacker must already hold a trusted non-owner team administrator role. Per the precision rules PR:H means the action is authenticated (admin-level). Impact is availability-only (C:N/I:N): the owner is locked out of the team and its projects, files, fonts and media, but no data is read or altered and no code is executed. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is an insider/privilege-abuse or compromised-admin scenario rather than mass remote exploitation - the PR:H requirement sharply limits the attacker population. Note the only 'exploit' artifact present is the vendor's remediation commit, which is a patch, not weaponized exploit code; do not conflate the two.

A disgruntled or compromised non-owner team administrator calls the delete-team-member RPC targeting the team owner. Because the pre-2.18.0 code only prevented self-deletion and never checked owner status, the owner's team-profile-rel membership is removed, locking them out of all team projects, files, fonts and media. No public exploit exists; the fix (commit 45f0153) adds a :cant-remove-owner check that blocks non-owners from removing an owner.