CVE-2026-113596: falha de baixa gravidade em webstudio-is webstudio
Webstudio before 0.256.0 Information Disclosure via tRPC publishedBuilds and findManyByIds
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 2.3epss 0.4%
Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user's project UUID can query the /trpc handler to retrieve publish history, titles, domains, preview images, and latest builds.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
webstudio-is · webstudioCVEs relacionadas — webstudio-is webstudio
No mesmo produto, das mais perigosas para as menos.
Referências
https://github.com/webstudio-is/webstudio/blob/0.255.0/packages/dashboard/src/db/projects.tshttps://github.com/webstudio-is/webstudio/blob/0.255.0/packages/project/src/trpc/project-router.tshttps://github.com/webstudio-is/webstudio/commit/348d049ed2763d2b6c3e00319fa9086ca67c8aa6https://github.com/webstudio-is/webstudio/issues/5621https://github.com/webstudio-is/webstudio/releases/tag/0.256.0https://www.vulncheck.com/advisories/webstudio-before-0.256.0-information-disclosure-via-trpc-publishedbuilds-and-findmanybyids