Webstudio CVE-2026-113596

Exploitation requires (1) a valid authenticated user account on the target Webstudio instance (PR:L) and (2) knowledge of another user's project UUID - the AT:P attack requirement in the CVSS vector - because the publishedBuilds and findManyByIds tRPC procedures in versions before 0.256.0 performed no ownership or permission check. No user interaction by the victim is needed. The principal limiting factor is that project UUIDs are unguessable random identifiers, so an attacker must obtain the target UUID out-of-band (shared links, referrals, logs). Impact is further bounded to read-only disclosure of project metadata (publish history, titles, domains, preview images, latest builds) - there is no write access and no exposure of full project source. Fixed in 0.256.0.

This is a low-priority issue, and the available signals are consistent rather than conflicting. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N) yields a base score of 2.3 (Low): network-reachable but requiring valid authentication (PR:L) and a specific attack requirement (AT:P) - namely prior knowledge of the victim's project UUID - with only limited confidentiality impact and no integrity or availability impact. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no public exploit code is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The source-code diff confirms the root cause (findManyByIds and the publishedBuilds tRPC path lacked an ownership/permission filter, now fixed by filtering on userId OR marketplace-approval and by adding getProjectPermit authorization), which raises confidence that the flaw is real - but the impact ceiling is narrow (read-only exposure of project metadata). Net: a genuine authorization (IDOR) weakness that is correctly scored low; it warrants routine patching rather than emergency response.

An attacker with a valid authenticated Webstudio account learns another tenant's project UUID (e.g. from a shared URL, referral, or log) and sends a crafted request to the /trpc handler invoking the publishedBuilds or findManyByIds procedures with that UUID. The server, lacking an ownership check in versions before 0.256.0, returns the victim's publish history, titles, domains, preview images, and latest builds. No public exploit code is identified, and exploitation requires authentication plus knowledge of the unguessable UUID, limiting practical abuse.