Authorization Flaw in Webstudio Affects User Project Data Access
CVE-2026-113596

2.3LOW

Key Information:

Vendor

Webstudio-is

Status
Webstudio
Vendor
CVE Published:
20 October 2026

What is CVE-2026-113596?

Webstudio versions prior to 0.256.0 exhibit a missing authorization vulnerability, allowing authenticated users to access sensitive project data belonging to other users. This is achieved through the publishedBuilds and findManyByIds tRPC procedures. Attackers who possess another user's project UUID can exploit this flaw by querying the /trpc handler, which may result in unauthorized access to information such as publish history, project titles, domains, preview images, and the latest build details.

Affected Version(s)

webstudio 0 < 0.256.0

References

https://github.com/webstudio-is/webstudio/issues/5621
issue-tracking
https://github.com/webstudio-is/webstudio/commit/348d049e...
patch
https://github.com/webstudio-is/webstudio/releases/tag/0....
release-notes

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lighthousekeeper1212
leediay153 from Viettel Post
.