CVE-2026-105687 in Penpot
Summary
by MITRE • 10/06/2026
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team administrator to remove any member other than themselves but does not protect the team owner. A non-owner administrator can delete the owner's team-profile-rel membership and lock the owner out of the team and its projects, files, fonts, and media. This issue is fixed in version 2.18.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified in Penpot versions prior to 2.18.0 represents a critical authorization flaw within the platform's role-based access control mechanism. Specifically, the delete-team-member Remote Procedure Call (RPC) endpoint fails to enforce proper administrative boundaries regarding team hierarchy. While the system correctly prevents administrators from deleting their own accounts, it lacks equivalent safeguards for the designated team owner. This oversight allows any user holding the administrator role on a Penpot team to unilaterally remove the team owner's membership profile relationship without triggering an authorization error or requiring additional verification steps.
From a technical perspective, this issue stems from insufficient validation of the target identity within the delete operation logic. The application checks whether the actor is attempting self-deletion but neglects to verify if the subject being deleted holds the highest privilege level associated with team ownership. By stripping the owner's membership record, the attacker effectively severs all logical connections between the legitimate owner and their organizational assets. This action does not merely remove access; it fundamentally alters the structural integrity of the team configuration by eliminating the primary entity responsible for governance.
The operational impact of this vulnerability is severe and potentially catastrophic for affected organizations. Once a non-owner administrator deletes the owner's membership, the actual team owner becomes locked out of their own workspace. This lockout extends across all resources managed within that team context, including design projects, shared files, custom fonts, and media assets. The loss of access can lead to significant operational disruption, data inaccessibility, and potential intellectual property exposure if alternative recovery mechanisms are not available. Furthermore, this scenario creates a risk of malicious intent where an insider threat could permanently exclude the rightful owner from critical business tools.
This flaw aligns with CWE-269, which describes Improper Privilege Management, as it involves a user exercising privileges beyond their intended scope by manipulating administrative functions to bypass ownership protections. In terms of attack classification under MITRE ATT&CK, this behavior corresponds to T1078 Valid Accounts and specifically the sub-technique of using legitimate credentials with elevated permissions to disrupt service availability or gain unauthorized control over resources. The exploitation requires no authentication bypass beyond existing valid administrator credentials, making it a straightforward abuse of trust within the application's permission model.
To mitigate this risk, organizations must immediately upgrade Penpot to version 2.18.0 or later, where the developers have implemented checks to prevent administrators from deleting team owners. For environments unable to patch instantly due to operational constraints, temporary mitigations include restricting administrator privileges to a minimal set of trusted individuals and implementing strict audit logging on all membership modification events. Additionally, enforcing multi-factor authentication for administrative accounts can reduce the likelihood of credential compromise leading to such abuse. Regular review of user roles and permissions is also recommended to ensure that no single individual holds excessive power over critical team structures without oversight.