CVE-2026-44986

Deferred Deferred - Pending Action

Authentication Bypass in Penpot Design Tool

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

Penpot is an open-source design tool for design and code collaboration. Prior to 2.14.5, Penpot exposed teams_invitations.clj invitation tokens from create-team-invitations, embedded an existing profile id in auth.clj prepare-register-profile, and had auth.clj register-profile issue a session based on the invitation email match without password verification, allowing a registered user to take over any non-blocked profile. This issue is fixed in version 2.14.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-15

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-44986

EUVD

EUVD-2026-44699

Affected Vendors & Products

Vendor	Product	Version / Range
penpot	penpot	2.14.5
penpot	penpot	to 2.15.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

CVE-2026-44986 is a critical vulnerability in Penpot versions before 2.14.5 that allows pre-authenticated account takeover. It involves three flaws: leaking invitation tokens in API responses, embedding existing profile IDs in tokens without verification, and creating sessions without password checks. An attacker can exploit this to take over any non-blocked profile, including admin accounts, without the victim's knowledge or interaction.

Detection Guidance

This vulnerability involves leaked invitation tokens and improper session creation in Penpot. To detect it, check Penpot API responses for exposed tokens in team invitation endpoints and verify if registration flows allow session creation without password verification. Inspect logs for unusual registration attempts or sessions created without proper authentication.

Impact Analysis

This vulnerability allows attackers to take over your Penpot account without your knowledge or interaction. They can access your designs, collaborate on projects, and potentially gain administrative privileges if you are an admin. The attack requires no special privileges and works on both cloud-hosted and self-hosted instances.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive design data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Unauthorized access may result in data breaches, requiring breach notifications and potential fines under these regulations.

Mitigation Strategies

Upgrade Penpot to version 2.14.5 or later to address the vulnerability. Ensure no API responses leak invitation tokens and verify registration flows enforce email-based profile resolution without embedded IDs.

Hi! I’m here to help you understand CVE-2026-44986. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70