Role Escalation Vulnerability in Penpot Design Platform
CVE-2026-105688

6.7MEDIUM

Key Information:

Vendor

Penpot

Status
Penpot
Vendor
CVE Published:
5 October 2026

What is CVE-2026-105688?

Penpot, an open-source design and prototyping platform, has a vulnerability where a non-owner team administrator can improperly assign the owner role to another user. This occurs due to the lack of role-validation checks during the invitation process for team management. An administrator can invite a new account as an owner or create multiple owners, potentially leading to unauthorized control over the team. This issue is addressed in version 2.18.0.

Affected Version(s)

penpot < 2.18.0

References

https://github.com/penpot/penpot/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/penpot/penpot/commit/5efd9cc3c56894853...
x_refsource_MISC
https://github.com/penpot/penpot/releases/tag/2.18.0
x_refsource_MISC

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.