CVE-2026-105688Medium· 6.7▾ SunlitPenpot is an open-source design and prototyping platform. Prior to 2.18.0, create-team-invitations and the invitation acceptance path allow a non-owner team administrator to assign the owner role because invitation roles are persisted an…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 36.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, create-team-invitations and the invitation acceptance path allow a non-owner team administrator to assign the owner role because invitation roles are persisted and applied without the role-ceiling check used by update-team-member-role. An administrator can invite another account as an owner, create multiple owners, and then use the new owner account to obtain owner-only control over the team. This issue is fixed in version 2.18.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-105687Medium· 4.9Penpot is an open-source design and prototyping platform
CVE-2026-105694Medium· 5.4Penpot is an open-source design and prototyping platform
CVE-2026-105696Medium· 6.5Penpot is an open-source design and prototyping platform
CVE-2026-105695Medium· 5.9Penpot is an open-source design and prototyping platform
CVE-2026-105691Critical· 9.9Penpot is an open-source design and prototyping platform
CVE-2026-105692Medium· 5.4Penpot is an open-source design and prototyping platform