Penpot EUVD-2026-92712

Requires the attacker to possess at least one valid share link to the target file - even the most restrictive, zero-page, team-only link suffices to authenticate the get-view-only-bundle RPC call. Escalation only yields additional access when the same file has multiple share links with differing scopes; a file with a single share link exposes only its own token. No account login, user interaction, or non-default configuration is needed beyond holding a share-link URL. The key limiting factor is that the attacker must be in possession of a share link and that the gain is bounded to the specific file's other share links and their page/comment/inspect scopes.

This is a genuine but moderate-severity broken-authorization issue (CWE-862), not a high-urgency priority. The provided CVSS 3.1 vector (5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) is internally consistent with the description: network-reachable, low-complexity, and formally 'unauthenticated' because a share link is a capability URL rather than an account credential. Impact is confidentiality-only and limited (C:L) - disclosure of other share links' secret IDs, page scopes, and comment/inspect permissions, enabling token replay to reach pages outside the attacker's original share; there is no integrity or availability impact. No EPSS score, SSVC decision, KEV listing, or packaged POC was provided in the input, so exploitation probability signals are absent rather than low - the only exploitation artifact is a regression test embedded in the fix commit. The CVSS PR:N label and the description's 'A holder of a restrictive link' phrasing are not contradictory, but note the practical precondition: the attacker must already possess a valid (even if restrictive) share link, so this is not reachable by a fully anonymous Internet attacker against an arbitrary file. Overall: a real data-exposure flaw worth patching, but the restricted impact and the share-link precondition place it below critical-triage urgency.

An attacker is given (or guesses access to) a restrictive, view-only Penpot share link for a file. They call the unauthenticated get-view-only-bundle RPC, which returns every share-link row for that file - including the secret IDs and broader scopes of more permissive links - and then replay a more permissive token to view pages, comments, and inspection data that were never included in their original share. No public weaponized exploit exists, though the fix commit includes a regression test that demonstrates the disclosure behavior. Attack vector is network with low complexity (AV:N/AC:L), requiring no user interaction.