CVE-2026-105684

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.18.0

Description The get-comment-threads, get-comment-thread, and get-comments RPC commands use the check-comment-permissions! function but fail to apply restrictions related to page-scoped share links. This allows a user with a page-scoped share link to retrieve comment threads and full comment bodies from other pages within the same file. The exposed information includes commenter names, email addresses, photos, and page identifiers. Furthermore, these page identifiers can be used with page-reading functionality to access design content that has not been shared.

Recommendations Update to version 2.18.0.