What is the CVSS score of CVE-2026-44986?

CVE-2026-44986 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

Which versions of Penpot are affected by CVE-2026-44986?

Penpot versions before 2.14.5 contain a critical account takeover vulnerability (CVSS 9.9) allowing any authenticated user to seize control of other users' profiles without their passwords, directly…. A patch is available.

How to fix or mitigate CVE-2026-44986?

Within 24 hours: Inventory all Penpot instances and verify their versions; contact Penpot support for patch status and timeline. Within 7 days: implement compensating controls listed below, enable enhanced logging of profile access and team invitation activities, and audit recent account changes for unauthorized access. Within 30 days: upgrade all Penpot installations to version 2.14.5 or later as soon as released, then verify the fix through testing the team invitation workflow end-to-end.

Penpot CVE-2026-44986

EUVD-2026-44699 CRITICAL

Improper Authentication (CWE-287)

2026-07-15 GitHub_M

Authentication Bypass Penpot

9.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 15, 2026 - 17:48 EUVD

Source Code Evidence Fetched

Jul 15, 2026 - 15:49 vuln.today

Analysis Generated

Jul 15, 2026 - 15:49 vuln.today

CVE Published

Jul 15, 2026 - 15:08 cve.org

CRITICAL 9.9

DescriptionCVE.org

Penpot is an open-source design tool for design and code collaboration. Prior to 2.14.5, Penpot exposed teams_invitations.clj invitation tokens from create-team-invitations, embedded an existing profile id in auth.clj prepare-register-profile, and had auth.clj register-profile issue a session based on the invitation email match without password verification, allowing a registered user to take over any non-blocked profile. This issue is fixed in version 2.14.5.

AnalysisAI

Account takeover in Penpot before 2.14.5 allows an authenticated registered user to hijack any non-blocked profile without knowing its password. The flaw chains three defects: create-team-invitations leaks invitation tokens, prepare-register-profile embeds an existing profile's id into the prepared-register JWE, and register-profile then mints a session on an invitation email match while skipping password verification (CWE-287). …