CVE-2026-47068
LowCVSS 2.3Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
PhoenixStorybook before version 1.1.0 has an authorization bypass vulnerability via a user-controlled key, allowing cross-session PubSub topic injection through a URL parameter. An attacker can hijack communication between LiveView views and iframes.
Risk Assessment
The risk involves potential interception or eavesdropping of cross-session communication by an attacker, which could compromise data confidentiality and integrity.
Recommendation
Update PhoenixStorybook to version 1.1.0 or later and validate URL parameters before using them in PubSub.
Original NVD description (English source)
Authorization Bypass Through User-Controlled Key vulnerability in phenixdigital phoenix_storybook allows cross-session PubSub topic injection via a URL query parameter. 'Elixir.PhoenixStorybook.Story.ComponentIframeLive':handle_params/3 in lib/phoenix_storybook/live/story/component_iframe_live.ex reads a PubSub topic directly from params["topic"] and broadcasts {:component_iframe_pid, self()} on it with no check that the topic belongs to the requesting session. The shared PhoenixStorybook.PubSub is used to coordinate playground LiveViews with their iframes: a playground subscribes to a session-specific topic and uses the received iframe pid to direct subsequent control messages (variation state, theme switches, extra-assign payloads) via send/2. Because the iframe trusts the query parameter, an attacker who loads /storybook/iframe/<story>?topic=<victim_topic> causes their iframe process pid to be announced on the victim's topic. The victim's playground then addresses its private messages to the attacker's iframe process. This issue affects phoenix_storybook from 0.4.0 before 1.1.0.