Double Decoding Vulnerability in Canva Desktop by Canva
CVE-2026-92839

4.3MEDIUM

Key Information:

Vendor

Canva

Status
Canva
Vendor
CVE Published:
17 September 2026

What is CVE-2026-92839?

Canva Desktop versions prior to 1.125.0 are susceptible to a double decoding vulnerability in the deeplink handler. This weakness allows malicious actors to exploit the application, potentially leading to the loading of arbitrary same-origin content under the user's session. Such behavior may compromise user data and session integrity, posing a significant threat to user security.

Affected Version(s)

Canva Windows 0 < 1.125.0

References

https://trust.canva.com/?tcuUid=d98fa5aa-50ac-4e45-8fec-2...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

spoderx555 (Bugcrowd)
.