Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-share-link RPC retrieves a caller-selected share-link ID and verifies only that the caller can edit the parent file. It does not verify that the caller created the share link or has owner or administrator authority, allowing any file editor who knows a share-link UUID to delete links created by other users and revoke external reviewers' access.
This issue is fixed in version 2.18.0.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
Low
Partial data modification
Availability
Low
Partial disruption
CVSS Vector v3.1
Weakness Type (CWE)
References 4
https://github.com/penpot/penpot/commit/209aea83658f209c4189b531eeda0f3a638a0294
security-advisories@github.com
https://github.com/penpot/penpot/pull/11290
security-advisories@github.com
https://github.com/penpot/penpot/releases/tag/2.18.0
security-advisories@github.com
https://github.com/penpot/penpot/security/advisories/GHSA-8257-pm4f-cfhq
security-advisories@github.com