CVE-2026-44986
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
A vulnerability in Penpot prior to 2.14.5 allowed account takeover by exploiting invitation tokens, embedding a profile ID, and issuing a session based on email match without password verification.
Risk Assessment
An attacker can take over any non-blocked user account, leading to unauthorized access to projects and design data.
Recommendation
Immediately update Penpot to version 2.14.5 or later, which includes fixes for this vulnerability.
Original NVD description (English source)
Penpot is an open-source design tool for design and code collaboration. Prior to 2.14.5, Penpot exposed teams_invitations.clj invitation tokens from create-team-invitations, embedded an existing profile id in auth.clj prepare-register-profile, and had auth.clj register-profile issue a session based on the invitation email match without password verification, allowing a registered user to take over any non-blocked profile. This issue is fixed in version 2.14.5.