CVE-2026-105692
Penpot: IDOR in Share-Link Deletion Allows Any File Editor to Delete Share-Links They Did Not Create
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-share-link RPC retrieves a caller-selected share-link ID and verifies only that the caller can edit the parent file. It does not verify that the caller created the share link or has owner or administrator authority, allowing any file editor who knows a share-link UUID to delete links created by other users and revoke external reviewers' access. This issue is fixed in version 2.18.0.
| CWE | CWE-284 CWE-639 |
| Vendor | penpot |
| Product | penpot |
| Published | Oct 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for penpot penpot
Be the first to know when new medium vulnerabilities affecting penpot penpot are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low
Affected Versions
penpot / penpot
< 2.18.0