CVE-2026-44986criticalCWE-287CWE-639

CVE-2026-44986: falha crítica em penpot

Penpot: Pre-authenticated account takeover via team-invitation token + prepare-register-profile

Publicada em

Seguir esta CVE+ Monitorar penpot

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.9epss 0.5%
Penpot is an open-source design tool for design and code collaboration. Prior to 2.14.5, Penpot exposed teams_invitations.clj invitation tokens from create-team-invitations, embedded an existing profile id in auth.clj prepare-register-profile, and had auth.clj register-profile issue a session based on the invitation email match without password verification, allowing a registered user to take over any non-blocked profile. This issue is fixed in version 2.14.5.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
penpot · penpot
CVEs relacionadas — penpot

No mesmo produto, das mais perigosas para as menos.

CVE-2026-100868MEDIUMPenpot before 2.18.0 Unauthenticated WebSocket Access via MCP BridgeEPSS 0.5%CVE-2026-26202HIGHPenpot has Arbitrary File Read via create-font-variant RPC endpointEPSS 0.5%CVE-2026-105691CRITICALPenpot: Authenticated OS Command Injection in Penpot SVG Exporter via Legacy fill-colorEPSS 0.5%CVE-2026-47665HIGHPenpot: Stored XSS via comment content, innerHTML renders unsanitized HTMLEPSS 0.4%CVE-2026-45805HIGHPenpot: MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCEEPSS 0.4%CVE-2026-45806HIGHPenpot: Authenticated SSRF in remote image import via create-file-media-object-from-urlEPSS 0.4%