Access Control Vulnerability in Penpot Design Platform

CVE-2026-105684

What is CVE-2026-105684?

The Penpot design and prototyping platform has a significant access control vulnerability that allows users with page-scoped share links to retrieve comment threads andfull comment bodies from other pages within the same design file. This issue originates from the lack of proper enforcement of page restrictions in the get-comment-threads, get-comment-thread, and get-comments RPC commands. As a result, sensitive information including commenter names, email addresses, and photos can be exposed, along with the ability to access unshared design content through disclosed page identifiers. This vulnerability has been addressed in version 2.18.0, ensuring improved security and user privacy.

References