Penpot CVE-2026-105696

Three concrete prerequisites must all hold: (1) the attacker possesses a valid Penpot share link granting blanket read access to the target file; (2) the attacker has their own authenticated Penpot session, because the get-page RPC requires authentication; and (3) the attacker knows the identifier (random UUID) of a page in that file that is outside the share link's authorized pages set. The same applies to the get-file-fragment RPC, which permitted share-link access without mapping fragments to authorized pages. Limiting factors that reduce real-world risk: exploitation is confined to pages within the same file the attacker already has a share link to; the target page-id is a random UUID that must be known or leaked (it is not enumerable by design); and the flaw yields only read access to design/shape data (no modification or denial of service). Fixed configurations are any deployment running Penpot 2.18.0 or later.

This is a medium-severity information-disclosure flaw (CVSS 6.5). The provided vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates a remote, authenticated attacker with low complexity and no user interaction can achieve high confidentiality impact with no integrity or availability impact - consistent with the CWE-862 missing-authorization (IDOR-style) nature of the bug. No EPSS probability, CISA KEV listing, or public proof-of-concept is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is materially lower than the raw CVSS number suggests because exploitation is gated by three stacked prerequisites: possession of a valid share link, a separate authenticated Penpot session of the attacker's own, and knowledge of the target page's random UUID. Impact is also bounded - an attacker can only read other pages within the same file for which they already hold a share link, not arbitrary cross-file or cross-tenant data. This is a legitimate confidentiality concern for multi-tenant/SaaS or collaborative self-hosted Penpot deployments where scoped share links are widely distributed, but it is not a mass-exploitation or wormable candidate; remediation is a straightforward upgrade to 2.18.0.

An owner shares a Penpot file via a share link scoped to read only one page. An attacker who holds that share link and is logged into their own Penpot account learns or obtains the UUID of a different (unauthorized) page in the same file and calls the authenticated get-page (or get-file-fragment) RPC with that page-id, receiving the complete shape and design data of the out-of-scope page. No public exploit code is identified at time of analysis.