storybookjs storybook up to 8.6.18/9.1.20/10.6.1/11.0.0-alpha.5 improper authorization

Summaryinfo

A vulnerability labeled as critical has been found in storybookjs storybook up to 8.6.18/9.1.20/10.6.1/11.0.0-alpha.5. Impacted is an unknown function. Executing a manipulation can lead to improper authorization. The identification of this vulnerability is CVE-2026-114125. The attack may be launched remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in storybookjs storybook up to 8.6.18/9.1.20/10.6.1/11.0.0-alpha.5. It has been declared as critical. This vulnerability affects an unknown part. The manipulation with an unknown input leads to a improper authorization vulnerability. The CWE definition for the vulnerability is CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origin restrictions can allow attacker-controlled events to reach the running preview. A developer must visit the malicious website and interact with the injected interface. The attack can cause unauthorized changes to story files and, if a changed file is later executed by a local runtime, arbitrary code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-114125 since 10/20/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1548.002.

Upgrading to version 8.6.19, 9.1.21, 10.6.2 or 11.0.0-alpha.6 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• storybookjs

Name

• storybook

Version

• 8.6.0
• 8.6.1
• 8.6.2
• 8.6.3
• 8.6.4
• 8.6.5
• 8.6.6
• 8.6.7
• 8.6.8
• 8.6.9
• 8.6.10
• 8.6.11
• 8.6.12
• 8.6.13
• 8.6.14
• 8.6.15
• 8.6.16
• 8.6.17
• 8.6.18
• 9.1.0
• 9.1.1
• 9.1.2
• 9.1.3
• 9.1.4
• 9.1.5
• 9.1.6
• 9.1.7
• 9.1.8
• 9.1.9
• 9.1.10
• 9.1.11
• 9.1.12
• 9.1.13
• 9.1.14
• 9.1.15
• 9.1.16
• 9.1.17
• 9.1.18
• 9.1.19
• 9.1.20
• 10.6.0
• 10.6.1
• 11.0.0-alpha.0
• 11.0.0-alpha.1
• 11.0.0-alpha.2
• 11.0.0-alpha.3
• 11.0.0-alpha.4
• 11.0.0-alpha.5

Website

• Product: https://github.com/storybookjs/storybook/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion