CVE-2026-105684

Executive Summary

CVE-2026-105684 is a broken access control vulnerability in Penpot, an open-source design and prototyping platform, affecting all versions prior to 2.18.0. Three RPC commands — get-comment-threads, get-comment-thread, and get-comments — validate comment permissions via check-comment-permissions! but fail to enforce the pages restriction associated with a page-scoped share link. This allows an attacker holding a page-scoped share link to retrieve comment threads and full comment bodies from other pages within the same file, exposing commenter names, email addresses, photos, and page identifiers. The disclosed page identifiers can then be leveraged against affected page-reading functionality to access unshared design content.

Technical Analysis

The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and stems from an authorization logic flaw rather than a memory-safety or injection defect. Penpot uses a share-link model in which a link can be scoped to a single page within a file, rather than to the whole file. Access control for comments is enforced through the check-comment-permissions! routine invoked by three RPC endpoints: get-comment-threads, get-comment-thread, and get-comments. According to the NVD description, these commands correctly perform a permission check but do not apply the share link's pages restriction — meaning the check validates that the caller may read comments at all, but never narrows the result set to the page(s) the share link was scoped to.

The net effect is a horizontal privilege boundary violation within the file scope: a user whose share link grants access to page A can query the comment RPCs and receive comment data belonging to pages B, C, and beyond within the same file. Because the returned comment bodies are "full" (not redacted), the response data includes commenter names, email addresses, profile photos, and page identifiers. This is an information disclosure issue with a secondary escalation path: the leaked page identifiers are described as usable with "affected page-reading functionality" to retrieve unshared design content. That chained behavior converts a metadata/comment leak into potential exposure of the underlying design assets the page-scoped link was intended to protect.

The CVSS v3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) indicates a network-reachable, low-complexity attack requiring some level of privilege (possession of a valid page-scoped share link), no user interaction, no scope change, low confidentiality impact, and no integrity or availability impact. The PR:L rating reflects that the attacker must hold a share link — access is not anonymous — but the AC:L rating reflects that no special conditions or race windows are required once that link is in hand. CWE-200 aligns with the confidentiality-only impact.

Insufficient technical detail is available from the NVD description to specify the exact language/framework implementation, the precise RPC transport, or the internal structure of the permission check beyond what is quoted above. No public proof-of-concept, Nuclei template, or exploit code is known to exist at the time of writing, so the exploitation analysis below is derived strictly from the described access control gap.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (broken access control / missing authorization scope enforcement) and the specific behavior described in the NVD entry.

1. Reconnaissance / target identification. The attacker identifies a Penpot instance (self-hosted or reachable) and obtains a page-scoped share link. This is a low bar in realistic scenarios: share links are commonly distributed to external collaborators, contractors, clients, or posted in tickets and chat. Because the link is page-scoped, both the victim organization and the attacker may believe access is confined to one page.

2. Triggering the flaw class. Using the page-scoped share link credentials, the attacker invokes the comment RPC commands — get-comment-threads, get-comment-thread, or get-comments. Each command runs check-comment-permissions!, which passes because the link is valid for reading comments, but the share link's pages restriction is never applied to the query. The response therefore contains comment threads and full comment bodies from other pages in the same file.

3. Payload/execution method at the vulnerability-class level. No malicious payload is required. Exploitation is a simple authorization bypass executed by issuing legitimate RPC calls with an out-of-scope but otherwise valid share link. The "payload" is the request itself; the vulnerability is in the missing filter, not in crafted input. There is no injection, deserialization, or memory corruption component described.

4. Post-exploitation impact. Two data classes are exposed. First, comment data: commenter names, email addresses, photos, and page identifiers. These enable social engineering, phishing, and enumeration of internal personnel. Second, the leaked page identifiers can be supplied to affected page-reading functionality, allowing retrieval of design content on pages the share link was never meant to expose. This extends the blast radius from comment metadata to potentially sensitive design assets. The integrity and availability impacts are nil per the CVSS vector; the attack is read-only.

Impact Assessment

The CVSS v3.1 base score is 4.3 (Medium), with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. Network attack vector and low attack complexity mean any party with the share link can exploit it trivially and repeatedly. The PR:L subscore reflects the requirement to hold a page-scoped share link; this is a meaningful but often easily satisfied precondition in collaborative design workflows. UI:N means no victim action is needed at exploitation time. Scope is unchanged (S:U) — the flaw stays within Penpot's authorization boundary. Confidentiality impact is rated Low, reflecting that what is exposed is comment data and related identifiers rather than, for example, credentials.

Business impact centers on privacy and intellectual property. Leaked commenter email addresses and names are directly usable for targeted phishing and reconnaissance of an organization's design team. Leaked page identifiers enabling access to unshared design content can expose unreleased product designs, brand assets, or client work — a serious concern for agencies and product teams that segment work by page within a single Penpot file. Because Penpot deployments are frequently self-hosted, blast radius is per-instance and depends on how liberally page-scoped share links were distributed. There is no CISA KEV listing and no evidence of in-the-wild exploitation at the time of writing; EPSS has not yet been scored by FIRST.org.

Detection Guidance

Sigma Rule

title: Penpot Comment RPC Access Across Share-Link Page Scope (CVE-2026-105684)
id: 8f3c1a52-2b77-4d9e-9a10-cve2026105684
status: experimental
description: Detects Penpot RPC requests to comment endpoints that may indicate attempts to bypass page-scoped share-link restrictions.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105684
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1213
  - cve.2026.105684
logsource:
  category: webserver
detection:
  selection_rpc:
    cs-uri-query|contains:
      - 'get-comment-threads'
      - 'get-comment-thread'
      - 'get-comments'
  selection_method:
    cs-method: 'POST'
  condition: selection_rpc and selection_method
falsepositives:
  - Legitimate comment reads from users with file-scoped access
level: low

YARA Rule

rule CVE_2026_105684_Penpot_Comment_RPC
{
    meta:
        description = "Detects Penpot comment RPC command names associated with CVE-2026-105684 in traffic or log artifacts"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105684"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $rpc1 = "get-comment-threads" ascii wide nocase
        $rpc2 = "get-comment-thread" ascii wide nocase
        $rpc3 = "get-comments" ascii wide nocase
        $perm = "check-comment-permissions" ascii wide nocase
        $penpot = "penpot" ascii wide nocase

    condition:
        ($penpot or $perm) and any of ($rpc*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105684 Penpot Comment RPC Page-Scope Bypass Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"get-comment-threads"; nocase; http.uri; content:"get-comments"; nocase; classtype:attempted-recon; sid:2026105684; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-105684;)

Note: the above matches both endpoint tokens as an illustrative example; operators should split into separate signatures for the three discrete RPC command names (get-comment-threads, get-comment-thread, get-comments) tuned to their Penpot API URI structure.

Elastic Detection

sequence by source.ip with maxspan=1m
  [ network where http.request.method == "POST" and
      (http.request.body.text contains "get-comment-threads" or
       http.request.body.text contains "get-comment-thread" or
       http.request.body.text contains "get-comments") ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=penpot
| eval comment_rpc=if(match(_raw,"get-comment-threads|get-comment-thread|get-comments"),1,0)
| where comment_rpc=1
| stats count values(uri) as endpoints by src_ip, user, status
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="penpot,web,">
  <rule id="105684" level="6">
    <decoded_as>json</decoded_as>
    <field name="url">get-comment-threads|get-comment-thread|get-comments</field>
    <description>CVE-2026-105684: Penpot comment RPC call that may bypass page-scoped share-link restriction</description>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Per the NVD description, the issue is fixed in Penpot 2.18.0; no tracked source has yet corroborated a vendor patch artifact, vendor advisory, or signed release at time of writing.

1. Immediate mitigations. Treat page-scoped share links as if they grant file-wide comment read access until version 2.18.0 is confirmed deployed. Audit and revoke page-scoped share links, especially those distributed externally. Where possible, restrict share links to file scope with explicit least privilege, and rotate any link that may have been shared with untrusted parties. Monitor RPC calls to get-comment-threads, get-comment-thread, and get-comments for anomalous volume or cross-page patterns.
2. Patch/upgrade steps. Upgrade Penpot to version 2.18.0 or later once the release is verified as authentic via the official project channels. Because this build is treated as UNPATCHED by tracked sources, verify the release notes and changelog directly from the Penpot project before relying on it in production.
3. Long-term hardening. Enforce the share link's pages restriction consistently across all RPC commands at a central authorization layer rather than per-endpoint, to prevent similar omissions. Add automated tests that assert page-scoped links cannot read cross-page comments or identifiers. Review other endpoints that consume page identifiers for the same scope-bypass pattern. Apply least-privilege scoping to all external share links and instrument authorization failures for alerting.

References

• NVD — CVE-2026-105684: https://nvd.nist.gov/vuln/detail/CVE-2026-105684
• Penpot project (official site / release notes for 2.18.0): https://penpot.app
• CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html
• MITRE ATT&CK T1213 — Data from Information Repositories: https://attack.mitre.org/techniques/T1213/
• CISA Known Exploited Vulnerabilities catalog (not listed as of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• No proof-of-concept, exploit code, Nuclei template, or in-the-wild campaign evidence is known for this CVE at time of writing.