Authorization Bypass in Phenix Digital's Phoenix Storybook
CVE-2026-47068
2.3LOW
What is CVE-2026-47068?
The vulnerability in Phenix Digital's Phoenix Storybook allows attackers to exploit an authorization bypass through user-controlled parameters, enabling cross-session PubSub topic injections. When an attacker crafts a URL with a specific topic, the affected 'handle_params' function captures it without verifying ownership, resulting in messages sent to this unauthorized topic. As a consequence, the attacker can intercept and manipulate communications intended for legitimate users, posing significant security risks.
Affected Version(s)
phoenix_storybook 0.4.0 < 1.1.0
phoenix_storybook 8c2c97b0f505780fee4069988bf86736f51d35d7 < 6ee03f1c738d4436dde1b066cf65c80663d489f5
References
CVSS V4
Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Peter Ullrich
Christian Blavier
Jonatan Männchen