CVE-2026-44986

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.14.5

Description An issue exists where invitation tokens from create-team-invitations in teams invitations.clj are exposed. Additionally, an existing profile id is embedded in prepare-register-profile within auth.clj, and the register-profile function in auth.clj issues a session based on an invitation email match without requiring password verification. This combination allows a registered user to take over any non-blocked profile.

Recommendations Update to version 2.14.5.