CVE-2026-105696

Executive Summary

CVE-2026-105696 is an authorization bypass (CWE-862, Missing Authorization) in Penpot, an open-source design and prototyping platform, affecting all versions prior to 2.18.0. The get-page RPC endpoint fails to validate that a caller-supplied page-id belongs to the authorized page set associated with a share link, allowing an attacker who holds a valid share link and their own authenticated session to read the full shape and design data of arbitrary pages within the same file. With a CVSS v3.1 base score of 6.5, the flaw primarily threatens confidentiality of proprietary design assets; no public PoC, Nuclei template, or in-the-wild exploitation has been observed as of this report.

Technical Analysis

Penpot exposes design and prototyping functionality through RPC-style endpoints that support both authenticated sessions and share-link access paths. According to the NVD description, the get-page RPC accepts a permission object derived from a share link that grants blanket read access, but the handler does not verify that the page-id selected by the caller resides within the link's authorized pages set. In effect, the authorization decision is made at the file or link level, while the object-level (page-level) authorization check is omitted — a canonical broken-access-control pattern mapped to CWE-862.

The access model is further weakened by the fact that get-page requires authentication. The attacker is therefore not an anonymous internet user acting purely through a leaked link: they must possess a valid share link and their own authenticated Penpot session. This combination lowers the practical barrier because authenticated accounts are freely creatable on public or self-hosted instances, and share links are routinely distributed to external collaborators, clients, and contractors. Once both prerequisites are met, the missing page-to-link mapping allows enumeration or direct retrieval of design data from any page in the same file when the page identifier is known.

A second, related weakness is documented in the get-file-fragment RPC, which also permits share-link access without mapping returned fragments to the authorized pages set. This expands the same authorization gap to an additional data-retrieval surface, meaning the vulnerability class is not confined to a single endpoint but reflects a systemic pattern in how share-link permissions are scoped.

The vulnerable code path is best characterized at the vulnerability-class level rather than by individual function or symbol names, since the CVE description does not disclose internal handler names, parameter schemas beyond page-id, or the exact permission-object structure. No public exploit code or proof-of-concept is available; analysis is inferred from the vulnerability class (missing object-level authorization on a parameter-controlled resource identifier). The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates remote exploitation, low attack complexity, low privileges required (a standard authenticated account), no user interaction, unchanged scope, and a high confidentiality impact with no integrity or availability impact.

Exploitation Scenarios

No public PoC is available; the chain below is inferred from the vulnerability class and the facts stated in the NVD description.

1. Reconnaissance / target identification. The attacker identifies a reachable Penpot instance (public SaaS or self-hosted) and obtains a valid share link to a file, for example through collaboration channels, a forwarded link, or a public community share. The attacker also registers or otherwise holds a normal authenticated Penpot session on the same instance.

2. Triggering the missing authorization check. Using the share link together with the authenticated session, the attacker invokes the get-page RPC and supplies a page-id value that does not belong to the pages authorized by the share link. Because the handler accepts the share-link permission object with blanket read access but never validates that the page-id is in the link's authorized pages set, the request is served rather than rejected. The same defective scoping applies to the related get-file-fragment RPC, allowing fragment retrieval outside the link's authorized page set.

3. Payload / execution method. At the vulnerability-class level, the "payload" is simply a request containing an out-of-scope resource identifier — the attacker substitutes or enumerates page identifiers in the RPC call. No memory corruption, injection payload, or file upload is required; the exploit consists purely of issuing an otherwise well-formed API request with an unauthorized page-id.

4. Post-exploitation impact. Successful requests return the complete shape and design data of the targeted page, exposing proprietary UI designs, component structures, and potentially embedded text content. The attacker can repeat the technique against further page identifiers in the same file to reconstruct the design. No integrity or availability impact is expected — the flaw is a read-only confidentiality breach — but harvested design assets may enable competitive intelligence theft or downstream phishing that mimics legitimate product interfaces.

Impact Assessment

The CVSS v3.1 base score is 6.5 (Medium), driven by a High confidentiality impact (C:H) with no integrity (I:N) or availability (A:N) impact, unchanged scope (S:U), and a low-privilege authenticated attacker (PR:L) requiring no user interaction (UI:N) and exploitable over the network (AV:N) with low complexity (AC:L). The blast radius is bounded to files where the attacker already holds a valid share link, but within each such file the exposure can extend to every page whose identifier can be determined. Organizations using Penpot for confidential product design, client deliverables, or unreleased marketing assets face direct intellectual property loss. Because the required authenticated account is trivial to obtain on instances permitting open registration, the practical attack cost is low. The absence of integrity and availability impact means the compromise is silent — no data is modified and no service is disrupted, reducing the likelihood of detection through operational anomalies.

Detection Guidance

Sigma Rule

title: Penpot get-page Unauthorized Page Access via Share Link
id: 8f4c2a91-7d3e-4b6f-9c21-penpotcve105696
status: experimental
description: Detects requests to the Penpot get-page or get-file-fragment RPC that reference a page or fragment outside the authorized share-link scope, indicative of CVE-2026-105696 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105696
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: penpot
detection:
  selection_endpoint:
    cs-uri-query|contains:
      - 'get-page'
      - 'get-file-fragment'
  selection_params:
    cs-uri-query|contains:
      - 'page-id'
      - 'share'
  condition: selection_endpoint and selection_params
fields:
  - c-ip
  - cs-uri-query
  - cs-username
  - sc-status
falsepositives:
  - Legitimate share-link users accessing pages genuinely within their authorized set.
level: medium
tags:
  - attack.t1190
  - cve.2026.105696

YARA Rule

rule CVE_2026_105696_Penpot_GetPage_Abuse
{
    meta:
        description = "Detects Penpot RPC requests abusing share-link scope in get-page / get-file-fragment (CVE-2026-105696)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105696"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $rpc1 = "get-page" ascii nocase
        $rpc2 = "get-file-fragment" ascii nocase
        $p1   = "page-id" ascii nocase
        $p2   = "share" ascii nocase

    condition:
        ($rpc1 or $rpc2) and $p1 and $p2
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105696 Penpot get-page unauthorized page access via share link"; flow:established,to_server; http.uri; content:"get-page"; nocase; http.uri; content:"page-id"; nocase; http.uri; content:"share"; nocase; classtype:attempted-recon; reference:cve,2026-105696; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-105696; sid:2026105696; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [network where event.action == "network_flow" and
     url.query matches~ ".*get-page.*" and url.query contains "page-id"]
  [network where event.action == "network_flow" and
     url.query matches~ ".*get-file-fragment.*"]

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri_lower = lower(uri_query)
| where (like(uri_lower, "%get-page%") OR like(uri_lower, "%get-file-fragment%"))
    AND like(uri_lower, "%page-id%")
| stats count dc(uri_query) as unique_queries values(status) as statuses by src_ip, user
| where count > 5 OR unique_queries > 10
| sort - count

Wazuh OSSEC Rule

<group name="penpot,web,access_control,">
  <rule id="105696" level="10">
    <if_sid>31100</if_sid>
    <field name="url">get-page|get-file-fragment</field>
    <field name="url">page-id</field>
    <description>CVE-2026-105696: Possible Penpot get-page get-file-fragment share-link authorization bypass attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_105696,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The vendor documentation states the issue is fixed in Penpot version 2.18.0, but no advisory, commit, or package metadata confirming this fix has been tracked by our sources; treat patch status as unverified and validate against the upstream release before relying on it.

1. Immediate mitigations. Restrict the distribution of share links to explicitly trusted parties and audit existing links for over-broad scope. Where feasible, disable or limit share-link access on self-hosted instances until 2.18.0 is deployed. Enforce strict network access controls (VPN or IP allow-listing) for self-hosted Penpot deployments, and disable open self-registration so that the required authenticated account is not freely obtainable. Review registered accounts and share-link recipients for signs of unauthorized access. Monitor the get-page and get-file-fragment RPC endpoints for requests referencing out-of-scope page-id values.

2. Patch/upgrade steps. Upgrade Penpot to version 2.18.0 or later as soon as a verified release is available. Because patch evidence is not confirmed by tracked sources, independently verify the release notes and checksums before deployment. Prior to upgrading, back up the instance configuration and database, test the upgrade in a staging environment, and confirm that the page-to-link authorization check is enforced after the upgrade by attempting an out-of-scope page-id request with a limited share link.

3. Long-term hardening. Implement object-level authorization checks uniformly across all RPC handlers so that every resource identifier is validated against the caller's authorized set, not just against file- or link-level permissions. Adopt a policy of least privilege for share-link scopes, defaulting to the minimum pages required. Add regression tests that assert rejection of out-of-scope page-id and fragment requests. Enable comprehensive API logging with alerting on authorization-denied and anomalous data-retrieval patterns, and conduct periodic access reviews of share links and collaborator accounts.

References

• NVD — CVE-2026-105696: https://nvd.nist.gov/vuln/detail/CVE-2026-105696
• Penpot project and release information: https://penpot.app
• CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST CVSS v3.1 Specification: https://www.first.org/cvss/v3.1/specification-document

No threat actor campaigns, public PoC, Nuclei template, or exploit-in-the-wild evidence have been identified for CVE-2026-105696. CISA KEV status: not listed. EPSS: not yet scored by FIRST.org.