Medium severity · published Oct 5, 2026
CVE-2026-105692
Penpot: IDOR in Share-Link Deletion Allows Any File Editor to Delete Share-Links They Did Not Create
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-share-link RPC retrieves a caller-selected share-link ID and verifies only that the caller can edit the parent file. It does not verify that the caller created the share link or has owner or administrator authority, allowing any file editor who knows a share-link UUID to delete links created by other users and revoke external reviewers' access. This issue is fixed in version 2.18.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PE
penpot · penpot
< 2.18.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-105692
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-105692
x_refsource_CONFIRM
https://github.com/penpot/penpot/security/advisories/GHSA-8257-pm4f-cfhq
x_refsource_MISC
https://github.com/penpot/penpot/pull/11290
x_refsource_MISC
https://github.com/penpot/penpot/commit/209aea83658f209c4189b531eeda0f3a638a0294
x_refsource_MISC
https://github.com/penpot/penpot/releases/tag/2.18.0
More from penpot
9.9
CVE-2026-105691
Penpot: Authenticated OS Command Injection in Penpot SVG Exporter via Legacy fill-color
9.9
CVE-2026-44986
Penpot: Pre-authenticated account takeover via team-invitation token + prepare-register-profile
8.8
CVE-2026-45805
Penpot: MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE
8.7
CVE-2026-47665
Penpot: Stored XSS via comment content, innerHTML renders unsanitized HTML
7.7
CVE-2026-45806
Penpot: Authenticated SSRF in remote image import via create-file-media-object-from-url