CVE-2026-105687

Executive Summary

CVE-2026-105687 is a privilege-abuse / improper access control vulnerability in Penpot, the open-source design and prototyping platform, affecting all versions prior to 2.18.0. The delete-team-member RPC does not protect the team owner, allowing a non-owner team administrator to delete the owner's team-profile-rel membership and lock the legitimate owner out of the team and all associated resources (projects, files, fonts, media). Successful exploitation results in complete denial of access to a team workspace for its owner, with an availability impact rated High under CVSS 3.1 (score 4.9).

Technical Analysis

Penpot is a self-hosted or cloud-hosted design and prototyping platform commonly deployed inside enterprises as an alternative to proprietary design tools. Teams, membership roles, and access to design assets (projects, files, fonts, media) are managed through backend Remote Procedure Calls (RPCs). One such RPC, delete-team-member, is intended to allow team administrators to remove members from a team.

The vulnerability is an instance of CWE-269 (Improper Privilege Management). According to the NVD description, prior to version 2.18.0 the delete-team-member RPC permits a team administrator to remove any member other than themselves, but does not exclude or otherwise protect the team owner. The owner's membership is modeled as a team-profile-rel relationship (a team-to-profile relational membership record). Because the RPC performs no role-hierarchy or owner-protection check, a non-owner administrator can invoke it against the owner's team-profile-rel membership. Once that membership record is removed, the owner loses their association with the team and is therefore locked out of the team and everything scoped to it — projects, files, fonts, and media.

Key characteristics derivable strictly from the advisory:

• Attack vector: Network (AV:N) — the RPC is reachable over the network interface of the Penpot deployment.
• Privileges required: High (PR:H) — the attacker must already hold a team administrator role, but not ownership.
• User interaction: None (UI:N) — the owner does not need to take any action; the deletion is server-side.
• Scope: Unchanged (S:U) — impact remains within the Penpot team/authorization context.
• Confidentiality/Integrity: None (C:N/I:N) — the advisory frames the outcome as loss of access.
• Availability: High (A:H) — the owner is fully locked out of the team and its assets.

The root cause is a missing authorization/ownership invariant in server-side membership-deletion logic: the delete operation validates the caller's administrator role but fails to enforce the rule that the team owner cannot be removed (or that removal requires owner-level privileges). This is a classic "peer/equal-or-lower privilege destroying a higher-or-protected subject" flaw. The advisory does not disclose specific function signatures, source files, or HTTP paths beyond the RPC name delete-team-member; no additional code-level detail is available and none should be inferred.

No public proof-of-concept, Nuclei template, or exploit code is known at the time of writing.

Exploitation Scenarios

The following chain is inferred from the vulnerability class (improper authorization / missing ownership check) and the NVD description. No public PoC exists; specific implementation details not stated in the advisory are intentionally omitted.

1. Reconnaissance / target identification. The attacker identifies a reachable Penpot instance (self-hosted deployments are often exposed on the network or internet and identifiable by the Penpot web UI). The attacker obtains a legitimate account that has been granted the administrator role on a target team — for example a compromised, disgruntled, or over-provisioned admin/contractor account. Because PR:H, the attacker must already possess this elevated role; this distinguishes the flaw from an unauthenticated takeover.

2. Triggering the flaw class. Using the authenticated administrator session, the attacker invokes the delete-team-member RPC with the team owner as the target. The server-side handler verifies only that the caller is an administrator and that the target is "any member other than themselves," without checking whether the target is the protected owner. The ownership invariant is therefore bypassed, and the RPC proceeds to delete the owner's team-profile-rel membership record.

3. Execution method (vulnerability-class level). The action is a single authorized-RPC request carrying the owner's membership identifier. No special payload, injection, or memory-corruption primitive is required — the flaw is purely an authorization-logic defect, so the "payload" is simply the RPC call targeting the owner. No specific parameter names or request bodies are provided in the advisory and are not fabricated here.

4. Post-exploitation impact. With the owner's team-profile-rel record removed, the owner can no longer access the team or its contents — projects, files, fonts, and media become inaccessible to them. Practical effects include: operational denial of service against the design owner/team lead; potential disruption or loss of workflow continuity for the team; and, because the owner may be the designated recovery/authority figure, a governance and availability failure. Depending on whether any residual recovery path (e.g., re-invitation, instance admin recovery) exists, recovery may require out-of-band administrative intervention. The advisory states no confidentiality or integrity loss, so data is not stated to be exfiltrated or altered.

Impact Assessment

• CVSS 3.1 base score: 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H.
• Attack Vector (Network): exploitable remotely against the Penpot RPC surface; no local access required.
• Attack Complexity (Low): the requirement to know and target the owner's membership is trivial for an administrator; no race condition or special conditions are described.
• Privileges Required (High): the attacker must already be a team administrator — this constrains the population of potential attackers to privileged insiders or holders of compromised admin accounts.
• User Interaction (None): the owner need not act; deletion is server-initiated on the attacker's request.
• Scope (Unchanged): impact is confined to the Penpot team authorization domain.
• Confidentiality (None) / Integrity (None): no data disclosure or modification is described.
• Availability (High): the owner is fully locked out of the team and its assets — a direct availability/access impact.

Blast radius. Any Penpot team whose ownership is separated from its administrator population is at risk. Enterprise design organizations commonly separate an owning team lead from operational admins, making this a realistic insider-abuse or account-takeover escalation. Single-owner self-hosted instances with no separate administrator are lower risk (the owner is also the admin and cannot victimize themselves per the advisory). A compromised admin account converts this into a disruptive denial-of-access action against team leadership. CISA KEV: NO — no evidence of active exploitation. EPSS: not yet scored by FIRST.org (no value asserted).

Detection Guidance

Because exploitation is a legitimate-looking, authenticated RPC call rather than a malformed request, detection should focus on anomalous membership-deletion events and privileged action auditing. The following rules are illustrative and must be tuned to the deployment's logging (Penpot may not emit all of these events by default).

Sigma Rule

title: Penpot Unauthorized Team Owner Removal via delete-team-member RPC
id: 8f2a1c9e-4b7d-4e2a-9c1f-penpot0cve105
status: experimental
description: Detects deletion of a team owner's membership record by a non-owner administrator, indicative of CVE-2026-105687 abuse in Penpot < 2.18.0.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105687
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  product: penpot
  service: backend
detection:
  selection_rpc:
    rpc_name: 'delete-team-member'
  selection_owner:
    target_role|contains: 'owner'
  condition: selection_rpc and selection_owner
fields:
  - actor_user_id
  - actor_role
  - team_id
  - target_user_id
  - target_role
falsepositives:
  - Legitimate full team teardown or ownership transfer workflows
level: high
tags:
  - attack.t1098
  - cve.2026-105687

YARA Rule

rule CVE_2026_105687_Penpot_Delete_Team_Member_RPC
{
    meta:
        description = "Detects references to the vulnerable delete-team-member RPC associated with CVE-2026-105687 in Penpot source or logs"
        author = "valtersit.com Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105687"
        cve = "CVE-2026-105687"

    strings:
        $rpc  = "delete-team-member" ascii nocase
        $rel  = "team-profile-rel" ascii nocase
        $owner = "owner" ascii nocase

    condition:
        uint32(0) == 0x464C457F or true and filesize < 5MB and $rpc and (any of ($rel, $owner))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105687 Penpot delete-team-member RPC Targeting Team Owner"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"rpc"; nocase; http.request_body; content:"delete-team-member"; nocase; http.request_body; content:"owner"; nocase; classtype:attempted-admin; reference:cve,2026-105687; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-105687; sid:2026105687; rev:1;)

Elastic Detection

sequence by user.id with maxspan=5s
  [ process where event.action == "team-member-role-check" and penpot.actor.role : "admin" ]
  [ process where event.action == "delete-team-member" and penpot.target.role : "owner" ]

Splunk SPL Query

index=penpot sourcetype=penpot:backend
| search rpc_name="delete-team-member"
| eval owner_removed=if(lower(target_role)="owner",1,0)
| where owner_removed=1
| stats count min(_time) as first_seen max(_time) as last_seen values(actor_role) as actor_roles values(team_id) as team_ids by actor_user_id target_user_id
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="penpot,">
  <rule id="105687" level="12">
    <decoded_as>json</decoded_as>
    <field name="rpc_name">delete-team-member</field>
    <field name="target_role">owner</field>
    <description>CVE-2026-105687: Non-owner admin attempted to delete Penpot team owner membership via delete-team-member RPC</description>
    <mitre>
      <id>T1098</id>
    </mitre>
    <group>penpot_access_control,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Although the NVD description states the issue is fixed in Penpot 2.18.0, no vendor advisory, commit reference, release note, or package metadata corroborates this in tracked sources; Patch Sources list is empty. Treat 2.18.0 as the nominal fixed version per NVD and verify independently before relying on it.

1) Immediate mitigations (interim, while patch status is unverified):

• Enforce strict ownership/administrator separation. Ensure team owners are not also sole administrators where possible, and audit whether administrators who are not owners exist on sensitive teams — these are the accounts capable of mounting this attack.
• Least privilege for admin roles. Reduce the number of users holding team administrator rights; grant admin only where required. The attack requires PR:H (administrator), so shrinking the admin population directly shrinks exposure.
• Account protection. Enforce MFA and strong credentials for all administrator accounts, and monitor for compromised/hijacked admin sessions that could be used to trigger the RPC.
• Restrict network exposure. Limit access to self-hosted Penpot instances to trusted networks/VPN rather than the public internet where feasible, reducing opportunity for attacker recon and login.
• Audit and backup membership data. Maintain regular backups of team membership records and be prepared to restore a deleted team-profile-rel record if an owner is locked out. Confirm the instance-level admin recovery path for re-granting ownership.
• Monitoring. Enable/aggregate backend RPC logs and alert on any delete-team-member action targeting an owner (see Detection Guidance).

2) Patch / upgrade steps:

• Target Penpot 2.18.0 or later, which the NVD description identifies as the fixed version. Because patch confidence is unverified, confirm the fix exists in the official release notes/changelog and repository before relying on it.
• Stage the upgrade in a non-production environment, validate team/ownership behavior, then roll out.
• After upgrade, re-verify that a non-owner administrator can no longer delete the team owner's membership; test explicitly before declaring remediation complete.
• If your deployment tracks container images, verify the deployed image actually corresponds to the 2.18.0+ codebase.

3) Long-term hardening:

• Implement and test authorization invariants server-side: protected principals (e.g., team owner) must be exempt from member-removal operations, or such removal must require owner-level authority. Add regression tests covering role-hierarchy edge cases (admin removing owner, admin removing self, owner transfer).
• Adopt a consistent role/permission model with mandatory ownership-protection checks across all membership RPCs, not just delete-team-member.
• Centralize privileged-action auditing and alerting; treat any membership-destructive action against high-privilege principals as high severity.
• Include Penpot in vulnerability management and SBOM/version tracking so version drift (staying below 2.18.0) is detectable.

References

• NVD — CVE-2026-105687: https://nvd.nist.gov/vuln/detail/CVE-2026-105687
• CWE-269 — Improper Privilege Management: https://cwe.mitre.org/data/definitions/269.html
• Penpot project (official source and release notes; verify 2.18.0 fix independently): https://github.com/penpot/penpot
• MITRE ATT&CK T1098 — Account Manipulation: https://attack.mitre.org/techniques/T1098/
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-105687 not listed — no exploit-in-the-wild evidence at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild activity are associated with CVE-2026-105687 based on the provided intelligence. No public PoC, Nuclei template, or exploit code is available; the attack chain above is inferred from the vulnerability class.