CVE-2026-105692

Executive Summary

CVE-2026-105692 is an improper access control vulnerability in the open-source design and prototyping platform Penpot, affecting versions prior to 2.18.0. The vulnerability resides in the delete-share-link Remote Procedure Call (RPC), which fails to properly validate the caller's ownership or administrative authority over a specific share-link, allowing any user with file edit permissions to delete share links created by others. This results in a low-impact integrity and availability issue, primarily enabling the revocation of external reviewers' access and disruption of collaboration workflows.

Technical Analysis

Penpot is a web-based open-source design and prototyping platform. The vulnerability is classified as CWE-284: Improper Access Control. Specifically, the delete-share-link RPC endpoint retrieves a caller-selected share-link ID and verifies only that the caller can edit the parent file. It does not verify that the caller created the share link or has owner or administrator authority.

This missing authorization check allows any user with edit permissions on a file to delete any share link associated with that file, provided they know the share-link UUID. The attack surface is the RPC interface, which is accessible to authenticated users. The vulnerability does not require user interaction (UI:N) and can be exploited over the network (AV:N) with low attack complexity (AC:L) and low privileges (PR:L). The successful exploitation results in low integrity (I:L) and availability (A:L) impact, as it allows unauthorized deletion of share links, disrupting access for external reviewers.

Exploitation Scenarios

Based strictly on the NVD description, the attack chain for CVE-2026-105692 is as follows:

1. Reconnaissance/Target Identification: The attacker must have a valid account with edit permissions on a target Penpot file and must know the UUID of a share link created by another user. Share-link UUIDs are often shared in URLs or collaboration invites, making them discoverable through social engineering, log access, or by observing shared links.

2. Triggering the Flaw: The attacker sends a request to the delete-share-link RPC with the target share-link UUID. The server verifies only that the attacker can edit the parent file, not that the attacker owns the share link or has owner/admin authority.

3. Payload/Execution Method: The request is a standard RPC call, likely via HTTP POST, containing the share-link ID. No special payload is required beyond a valid session and the target UUID. The vulnerability is in the authorization logic, not in input handling.

4. Post-Exploitation Impact: Successful exploitation deletes the share link, revoking access for external reviewers who were using that link. This can disrupt collaboration, cause denial of access for legitimate users, and potentially be used in targeted harassment or sabotage. The attacker cannot escalate privileges or access additional data directly through this flaw.

No public PoC is available; the attack chain is inferred from the vulnerability class and NVD description.

Impact Assessment

The CVSS v3.1 score is 5.4 (Medium), with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. The impact is limited to integrity and availability, with no confidentiality impact. Affected systems are Penpot instances prior to 2.18.0. The blast radius is confined to the specific file and its share links. External reviewers lose access, potentially halting review processes. Business impact includes workflow disruption, loss of external collaboration, and potential reputational damage if share links are revoked maliciously. The low privileges required (any editor) increase the pool of potential attackers.

Detection Guidance

Sigma Rule

title: Penpot Unauthorized Share Link Deletion
id: 8f9a2b1c-4d3e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects attempts to delete share links via Penpot RPC without proper authorization.
author: Threat Intelligence
date: 2026-01-15
logsource:
  product: penpot
  service: rpc
detection:
  selection:
    event: "delete-share-link"
    user_role: "editor"
  condition: selection
falsepositives:
  - Legitimate deletion by share link owner
level: medium

YARA Rule

rule Penpot_Delete_Share_Link_Vulnerability
{
    meta:
        description = "Detects exploitation attempts of CVE-2026-105692"
        author = "Threat Intelligence"
        date = "2026-01-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105692"
    strings:
        $rpc_call = "delete-share-link"
        $uuid_pattern = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/
    condition:
        $rpc_call and #uuid_pattern > 0
}

Suricata IDS Rule

alert http any any -> any any (msg:"Penpot Unauthorized Share Link Deletion Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/rpc"; http_uri; content:"delete-share-link"; http_client_body; pcre:"/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/Ri"; classtype:attempted-user; sid:1000001; rev:1;)

Elastic Detection

process where event.action == "network" and
  network.protocol == "http" and
  http.request.method == "POST" and
  http.request.body contains "delete-share-link" and
  user.roles contains "editor"

Splunk SPL Query

index=penpot_logs sourcetype=penpot:rpc
| search "delete-share-link"
| rex field=_raw "share_link_id=(?<share_link_id>[a-f0-9\-]{36})"
| eval user_role=coalesce(user_role, "unknown")
| where user_role="editor"
| table _time, user, share_link_id, user_role, src_ip

Wazuh OSSEC Rule

<group name="penpot,">
  <rule id="100001" level="7">
    <decoded_as>json</decoded_as>
    <field name="event">delete-share-link</field>
    <field name="user_role">editor</field>
    <description>Penpot unauthorized share link deletion attempt detected</description>
    <mitre>
      <id>T1485</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in version 2.18.0, but no vendor advisory or patch source is currently tracked.

1. Immediate Mitigations:

   • Restrict file edit permissions to trusted users only.
   • Monitor RPC logs for delete-share-link calls by non-owner editors.
   • Implement network segmentation to limit access to Penpot instances.

2. Patch/Upgrade Steps:

   • Upgrade Penpot to version 2.18.0 or later as soon as it is available.
   • Verify the upgrade through official Penpot release channels.
   • After upgrading, audit share links to ensure they were not tampered with.

3. Long-Term Hardening:

   • Enforce role-based access control (RBAC) with least privilege.
   • Implement audit logging for all RPC actions, especially those affecting share links.
   • Regularly review and rotate share-link UUIDs.
   • Conduct security training for users on share-link handling.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-105692
2. Penpot GitHub Repository: https://github.com/penpot/penpot
3. Penpot Official Documentation: https://help.penpot.app/
4. CWE-284: Improper Access Control: https://cwe.mitre.org/data/definitions/284.html
5. No known threat actor campaigns or exploit-in-the-wild evidence at this time.