PT-2026-118456

CVE-2026-113596

Published

2026-10-20

Updated

2026-10-23

Description by

CVSS 3.1

3.1

Low

MetricsAV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Webstudio versions prior to 0.256.0

Description Authenticated users can access project data belonging to other users due to missing authorization. By knowing a project UUID, an attacker can query the '/trpc' endpoint using the publishedBuilds and findManyByIds tRPC procedures to retrieve information such as publish history, titles, domains, preview images, and the latest builds.

Recommendations Update to version 0.256.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Leediay153

Lighthousekeeper1212

Vendors

Affected products

Weakness enumeration

CWE-639: Authorization Bypass Through User-Controlled Key