CVE-2026-105693

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.18.0

Description An issue exists in the unauthenticated get-view-only-bundle RPC (Remote Procedure Call) that returns all share-link rows for a file, regardless of whether the caller authenticated with a single scoped share link. An attacker possessing a restrictive link can retrieve secret IDs, page scopes, comment permissions, and inspection permissions of other links. This information can be used to replay a more permissive token to access page data not included in the original share.

Recommendations Update to version 2.18.0.