Description

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread, and get-comments RPC commands use check-comment-permissions! but do not apply the share link's pages restriction. A holder of a page-scoped share link can retrieve comment threads and full comment bodies from other pages in the same file, including commenter names, email addresses, photos, and page identifiers. The disclosed page identifiers can also be used with affected page-reading functionality to access unshared design content. This issue is fixed in version 2.18.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-10-05T20:17:17.343Z",
  "pubdate": "2026-10-05T20:17:17.343Z",
  "executiveSummary": "A broken access control vulnerability exists in Penpot prior to version 2.18.0, stemming from improper authorization checks within specific RPC commands. The flaw permits users possessing restricted, page-scoped share links to bypass intended boundary limitations. Consequently, an unauthorized actor can gain access to sensitive information, including full comment threads, user metadata such as email addresses and photos, and unauthorized design content identifiers. This represents a significant exposure of private project data, enabling attackers to view information from pages they were not granted access to within the same file. The vulnerability affects the confidentiality and integrity of design assets, as disclosed page identifiers can be leveraged to interact with other unauthorized functionality, further broadening the scope of the data breach. The issue requires no escalated privileges beyond the possession of a valid, yet restricted, share link, making the exploitation vector accessible to any user with legitimate but limited access to the environment.",
  "technicalDetails": "The root cause of this vulnerability lies in an insufficient implementation of authorization logic within the RPC command processing architecture. Specifically, the RPC functions 'get-comment-threads', 'get-comment-thread', and 'get-comments' rely on the 'check-comment-permissions!' function, which fails to adequately validate or enforce the constraints associated with page-scoped share links. While these commands correctly identify if a user has baseline access to comment-related functions, they ignore the granular scoping required to restrict access to a specific page identifier.\nThe exploitation flow begins when an attacker, already in possession of a page-scoped share link, targets the affected RPC endpoints. By invoking these commands, the attacker bypasses the internal scoping mechanism that should otherwise restrict requests to the specific page assigned to the link. Because the 'check-comment-permissions!' function does not integrate the share link's page-level restriction, the application server returns the requested comment data—including metadata such as full comment bodies, commenter names, email addresses, and profile photographs—for all pages residing within the same parent design file, regardless of the attacker's actual authorization level for those specific pages.\nFurthermore, the disclosure of these unintended page identifiers serves as a secondary exploitation vector. The system returns the identifiers for pages that were intended to remain private. An attacker can harvest these page identifiers and feed them into other affected page-reading RPC functions, which trust the provided identifiers without cross-referencing them against the user's initial scope of authorization. This allows the attacker to traverse the design file, accessing unauthorized design content that is otherwise hidden from the limited user profile. The vulnerability effectively turns a restricted, page-scoped access token into a file-wide information disclosure mechanism. The exploitation requires the attacker to have at least one valid, restricted link to a file within the system, but does not require administrative access, complex social engineering, or knowledge of system-level credentials. This flaw is fully remediated in Penpot 2.18.0, where the RPC command logic was updated to strictly enforce the page-scoped restriction in conjunction with the existing comment permission checks."
}