CVE-2026-105684 in Penpot
Summary
by MITRE • 10/06/2026
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread, and get-comments RPC commands use check-comment-permissions! but do not apply the share link's pages restriction. A holder of a page-scoped share link can retrieve comment threads and full comment bodies from other pages in the same file, including commenter names, email addresses, photos, and page identifiers. The disclosed page identifiers can also be used with affected page-reading functionality to access unshared design content. This issue is fixed in version 2.18.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified in Penpot versions prior to 2.18.0 represents a critical authorization bypass within the platform's comment management subsystem, specifically affecting the RPC commands get-comment-threads, get-comment-thread, and get-comments. While these endpoints correctly invoke the check-comment-permissions! function to validate user access rights for specific comments or threads, they fail to enforce page-scoped restrictions associated with share links. This architectural flaw allows an attacker possessing a valid page-scoped share link for one specific page within a design file to bypass intended isolation boundaries and retrieve comment data from other pages in the same document that are not part of their authorized scope.
From a technical perspective, this is a classic example of Insecure Direct Object Reference combined with Broken Access Control. The application logic correctly verifies if the user has permission to view comments on the target page but neglects to cross-reference this against the constraints imposed by the share link's metadata. Consequently, an authenticated or semi-authenticated attacker can enumerate comment threads across all pages in a file rather than being restricted to the single shared page. This lack of proper scope validation undermines the fundamental security model of multi-page design files where different stakeholders may have access to distinct sections without visibility into others.
The operational impact of this vulnerability is significant due to the sensitive nature of the data exposed. The attacker can retrieve full comment bodies, which often contain detailed feedback on design elements, as well as metadata including commenter names, email addresses, and profile photos. This constitutes a serious privacy violation and potential exposure of personally identifiable information in accordance with regulations such as GDPR or CCPA if internal team members are commenting. Furthermore, the disclosed page identifiers serve as additional attack vectors; these IDs can be leveraged alongside other affected page-reading functionalities to access unshared design content that was never intended for public viewing, effectively escalating a low-level read privilege into broader unauthorized access of intellectual property and confidential project details.
This vulnerability aligns with CWE-284 Improper Access Control and CWE-601 URL Redirection to Untrusted Destination if the page identifiers are used in subsequent requests, though primarily it falls under CWE-862 Missing Authorization. In terms of the MITRE ATT&CK framework, this behavior corresponds to T1530 Data from Cloud Storage or T1005 Data from Local System depending on deployment context, specifically illustrating how improper access control leads to unauthorized data exfiltration. The ability to map out the entire file structure through page identifiers also aids in reconnaissance activities similar to T1619 Cloud Infrastructure Discovery.
Mitigation for this issue requires immediate upgrading of Penpot instances to version 2.18.0 or later, where the developers have implemented proper scope validation within the comment retrieval RPC commands. For organizations unable to patch immediately due to operational constraints, network-level controls such as Web Application Firewalls can be configured to monitor and restrict anomalous patterns in RPC calls that attempt to access resources outside of expected page scopes. Additionally, implementing strict input validation on client-side applications to prevent the construction of malicious requests using discovered page identifiers provides a secondary layer of defense. Regular security audits focusing on authorization logic for multi-tenant or multi-page resource sharing are recommended to identify similar flaws where scope boundaries might be incorrectly enforced in other parts of the application.