CVE-2026-113596

LowCVSS 3.1

Published: 20/10/2026(UTC)Updated: 23/10/2026(UTC)Translated: 20/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

20th percentile - higher than 20% of all known CVEs

Summary

Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user's project UUID can query the /trpc handler to retrieve publish history, titles, domains, preview images, and latest builds.

Risk Assessment

An authenticated attacker can access other users' project data, compromising information confidentiality. This may expose publish history, domains, and other project metadata.

Recommendation

Upgrade Webstudio to version 0.256.0 or later. Until patched, consider restricting access to the publishedBuilds and findManyByIds tRPC procedures.

Other vulnerabilities in Webstudio

CVE-2026-86119High
Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZE_ORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, access internal services, and perform network reconnaissance on the instance infrastructure.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS