CVE-2026-113596 in Webstudio
Summary
by MITRE • 10/20/2026
Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user's project UUID can query the /trpc handler to retrieve publish history, titles, domains, preview images, and latest builds.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified in Webstudio versions prior to 0.256.0 represents a critical failure in access control mechanisms within its application programming interface. Specifically, this flaw is categorized as an Insecure Direct Object Reference or Broken Access Control issue, aligning with CWE-639 and the ATT&CK technique T1078 for Valid Accounts exploitation. The core of the problem lies in how the backend handles requests to specific tRPC procedures named publishedBuilds and findManyByIds. These endpoints are designed to retrieve data related to user projects but fail to adequately verify that the authenticated requester is the legitimate owner or has explicit permission to access the requested resource. This architectural oversight allows any logged-in user, regardless of their relationship to the target project, to bypass intended privacy boundaries simply by knowing a specific identifier associated with another user's work.
From a technical perspective, the vulnerability exploits the lack of server-side authorization checks on these particular API endpoints. When an authenticated user submits a request containing a known Project UUID via the /trpc handler, the system processes the query without validating whether that user owns the project identified by the provided ID. Consequently, the application returns sensitive metadata and build artifacts associated with the target project. This behavior indicates a fundamental gap in implementing proper object-level security controls, where the identity of the requester is not cross-referenced against the ownership attributes of the requested data objects before serving them to the client.
The operational impact of this vulnerability is significant for users relying on Webstudio for hosting or managing web projects. An attacker can leverage this flaw to enumerate and extract a wide array of sensitive information about other users' deployments. This includes publish history, which may reveal deployment timelines and frequency; project titles and domains, which expose the identity and online presence of victims; preview images that might contain proprietary design elements or confidential visual assets; and details regarding latest builds, which could aid in further reconnaissance for more targeted attacks such as supply chain compromises or social engineering campaigns. The exposure of this data undermines user privacy and can facilitate subsequent malicious activities by providing attackers with valuable context about their targets.
To mitigate this vulnerability, immediate action is required to upgrade the Webstudio instance to version 0.256.0 or later, where these authorization checks have been properly implemented. In environments where upgrading is not immediately feasible, administrators should consider implementing a reverse proxy that enforces strict access control policies at the network level, although this is less effective than fixing the root cause in the application code. Furthermore, developers must review all API endpoints to ensure consistent implementation of ownership verification logic across the entire platform. Regular security audits and penetration testing focusing on broken object-level authorization are recommended to prevent similar flaws from being introduced in future updates.