CVE-2026-105693

Executive Summary

CVE-2026-105693 is a missing authorization vulnerability in Penpot, an open-source design and prototyping platform, affecting versions prior to 2.18.0. The unauthenticated get-view-only-bundle RPC returns every share-link row for a file even when the caller authenticated with only one scoped share link, allowing a holder of a restrictive link to harvest other links' secret IDs, page scopes, comment permissions, and inspection permissions. This permits replay of a more permissive token to access page data excluded from the original share, resulting in unauthorized read access to potentially sensitive design content.

Technical Analysis

The vulnerability is classified as CWE-862 (Missing Authorization). Penpot exposes an unauthenticated RPC named get-view-only-bundle, which is intended to serve view-only rendering data to holders of a scoped share link. Per the NVD description, this RPC returns every share-link row for a given file, rather than limiting its response to the single share link the caller presented. This constitutes a failure to enforce object-level authorization: the server does not scope the returned records to the authenticated (or link-scoped) principal.

Because the get-view-only-bundle RPC is reachable without full account authentication, an attacker who possesses any single valid share link—including the most restrictive one available—can invoke it and receive the full set of share-link metadata. The exposed fields explicitly enumerated in the description are:

• secret IDs — the tokens required to redeem each share link
• page scopes — which pages (or page subsets) each link grants
• comment permissions — whether a link permits commenting
• inspection permissions — whether a link permits inspection of design properties

The attack surface is the network-facing share-link RPC endpoint, which is by design internet-reachable for legitimate read-only collaborators. The flaw is not a memory-safety or injection issue; it is a pure authorization design defect in how sibling share-link records are filtered. CVSS 3.1 assigns AV:N (network), AC:L (low complexity), PR:N (no privileges required), UI:N (no user interaction), S:U (unchanged scope), with C:L (low confidentiality impact) and no integrity or availability impact—yielding a base score of 5.3. The "low" confidentiality rating reflects that exposure is scoped to file content and share metadata reachable through existing links, rather than full platform compromise.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (missing object-level authorization) and the facts stated in the NVD description. No function names, endpoints, or parameters beyond those given (get-view-only-bundle, share-link "secret IDs," "page scopes," "comment permissions," "inspection permissions") are asserted.

1. Reconnaissance / target identification. An attacker identifies a Penpot instance running a version prior to 2.18.0. Access to at least one valid share link for a target file is required. This could be obtained through a leaked or over-shared "view only" link, a link shared with a restricted external party, or one embedded in a public web page. The target is any file for which the attacker holds a more restrictive link than other links on the same file.

2. Triggering the flaw. The attacker calls the get-view-only-bundle RPC using the one share link they legitimately hold. Because the RPC does not scope its return to the presented link, the response includes share-link rows for all links tied to that file.

3. Payload / execution method at the class level. There is no exploit payload in the classic sense—the authorization defect is triggered by the ordinary RPC invocation. The "exploitation" is parsing the over-broad response to extract the secret IDs of sibling share links, together with their page scopes, comment permissions, and inspection permissions.

4. Post-exploitation impact. The attacker selects from the harvested metadata a link with broader permissions than their own and replays its secret ID to redeem a more permissive token. This grants access to page data that was not included in the original restrictive share, potentially exposing design assets, page content, and inspection/comment capabilities the original link lacked. The result is unauthorized read access (and comment/inspection privileges) beyond the intended scope.

Because the RPC is unauthenticated, no account is required, which lowers the barrier: possession of any single share link is sufficient to enumerate the others.

Impact Assessment

The primary impact is confidentiality (CVSS C:L). An attacker with a minimal share link can escalate to the union of permissions granted by any sibling share link on the same file. Impacts include:

• Data exposure: Page data outside the original share scope becomes readable, potentially exposing proprietary designs, unreleased product assets, or client material.
• Permission escalation within a file: Comment and inspection permissions from more permissive links become accessible, enabling interaction and inspection capabilities not originally granted.
• Metadata leakage: Secret IDs of all share links for the file are disclosed, which can facilitate further token replay.
• Blast radius: Scoped to files for which the attacker already holds at least one share link. There is no reported path to account takeover, code execution, or server compromise; scope is unchanged (S:U). Integrity and availability are unaffected (I:N/A:N).
• Business context: Design files often contain unreleased IP and client-confidential material. Organizations using Penpot for external collaboration and design handoff are most exposed.

EPSS has not yet been scored by FIRST.org, and CISA KEV does not list this CVE as of this report. No public exploit code or Nuclei template was observed in the provided data, suggesting exploitation is currently theoretical or low-volume.

Detection Guidance

Sigma Rule

title: Penpot get-view-only-bundle Share-Link Enumeration Attempt
id: 8f2c1a44-1056-93c0-9b21-penpot000001
status: experimental
description: Detects repeated or anomalous invocations of the Penpot get-view-only-bundle RPC, which prior to 2.18.0 returned all share-link rows for a file (CVE-2026-105693).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105693
author: valtersit.com
logsource:
  category: webserver
  product: generic
detection:
  selection_endpoint:
    cs-uri-query|contains: 'get-view-only-bundle'
  selection_method:
    cs-method: 'POST'
  condition: selection_endpoint and selection_method
falsepositives:
  - Legitimate view-only share link rendering by authorized collaborators
level: medium
tags:
  - attack.t1190
  - cve.2026-105693

YARA Rule

rule CVE_2026_105693_Penpot_ShareLink_Enumeration
{
    meta:
        description = "Detects references to the Penpot get-view-only-bundle RPC associated with CVE-2026-105693"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105693"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $rpc = "get-view-only-bundle" ascii wide nocase
        $f1  = "page-scope" ascii wide nocase
        $f2  = "inspection" ascii wide nocase
        $f3  = "secret-id" ascii wide nocase

    condition:
        $rpc and (any of ($f*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105693 Penpot get-view-only-bundle share-link enumeration attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"get-view-only-bundle"; nocase; classtype:attempted-recon; reference:cve,2026-105693; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-105693; sid:2026105693; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [ network where network.protocol == "http" and http.request.method == "POST"
      and stringContains(url.query, "get-view-only-bundle") ]
  [ network where network.protocol == "http" and http.response.status_code == 200 ]

Splunk SPL Query

index=web OR index=proxy (method=POST OR http_method=POST)
| eval uri_lower=lower(uri)
| where like(uri_lower, "%get-view-only-bundle%")
| stats count min(_time) as first_seen max(_time) as last_seen values(status) as status_codes by src_ip, uri, http_user_agent
| where count >= 3
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="penpot,web,cve-2026-105693,">
  <rule id="1056931" level="6">
    <if_sid>31100</if_sid>
    <match>get-view-only-bundle</match>
    <description>CVE-2026-105693: Possible Penpot share-link enumeration via get-view-only-bundle RPC</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_105693,attempted_recon,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence was available from any tracked source at the time of this report; the following is based solely on the vendor's stated fixed version in the NVD description.

1. Immediate mitigations. Restrict network access to Penpot instances and share-link RPC endpoints to trusted networks or authenticated users where feasible. Rotate or invalidate existing share links for sensitive files, since secret IDs for all links on a file can be enumerated by any holder of a single link. Audit which files have multiple share links with divergent scopes and reduce unnecessary link proliferation. Where a reverse proxy or WAF is in front of Penpot, monitor for anomalous get-view-only-bundle invocation patterns and consider rate-limiting or blocking based on the detection rules above.

2. Patch / upgrade steps. Upgrade Penpot to version 2.18.0 or later, per the NVD description stating the issue is fixed in 2.18.0. Verify the running version after upgrade and re-test share-link scoping behavior to confirm the RPC now returns only the share link corresponding to the presented token.

3. Long-term hardening. Enforce object-level authorization on all share-link RPCs so responses are scoped to the presented credential. Adopt least-privilege share-link defaults and routinely expire restrictive links. Instrument logging for authorization anomalies and integrate the detection rules above into SOC monitoring. Track the NVD entry for CVSS/EPSS updates and any future vendor advisory.

References

• NVD — CVE-2026-105693: https://nvd.nist.gov/vuln/detail/CVE-2026-105693
• Penpot project / release notes for version 2.18.0 (vendor fix reference): https://penpot.app
• CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• FIRST EPSS (currently unscored for this CVE): https://www.first.org/epss
• CISA Known Exploited Vulnerabilities Catalog (this CVE not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence were identified in the provided data. No public PoC, exploit code, or Nuclei template was available at the time of writing.