CVE-2026-44986

CRITICAL 9.9

Penpot: Pre-authenticated account takeover via team-invitation token + prepare-register-profile

CVSS Score

9.9

EPSS Score

0.0%

EPSS Percentile

0th

Penpot is an open-source design tool for design and code collaboration. Prior to 2.14.5, Penpot exposed teams_invitations.clj invitation tokens from create-team-invitations, embedded an existing profile id in auth.clj prepare-register-profile, and had auth.clj register-profile issue a session based on the invitation email match without password verification, allowing a registered user to take over any non-blocked profile. This issue is fixed in version 2.14.5.

CWE	CWE-287 CWE-639
Vendor	penpot
Product	penpot
Published	Jul 15, 2026
Last Updated	Jul 15, 2026

Stay Ahead of the Next One

Get instant alerts for penpot penpot

Be the first to know when new critical vulnerabilities affecting penpot penpot are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

penpot / penpot

< 2.14.5

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/penpot/penpot/security/advisories/GHSA-4937-35vc-hqjj github.com: https://github.com/penpot/penpot/pull/9380 github.com: https://github.com/penpot/penpot/commit/9e681260ccc4feb6c564ff0773fb9594b462c574 github.com: https://github.com/penpot/penpot/releases/tag/2.14.5