Executive brief
Penpot, an open-source design and collaboration platform, contained a critical flaw that allowed any registered user to take over any other account on the same system. By exploiting a weakness in how the system handles team invitations and new user registrations, an attacker could gain full access to administrator accounts, customer data, or internal staff profiles without needing the victim's password. This could lead to the total compromise of all design projects and sensitive corporate data stored on the platform.
Technical details
A critical authentication bypass exists in Penpot's registration and invitation logic. The vulnerability stems from three combined issues: first, the `create-team-invitations` command leaks invitation tokens (JWE) in the API response instead of only sending them via email; second, `prepare-register-profile` fails to reject registration attempts for existing emails and embeds the existing victim's profile ID into a registration JWE; third, `register-profile` issues a valid session for that profile ID if a matching invitation token is provided, skipping password verification. An attacker with a standard account can invite a victim's email to a team they control, capture the leaked token, and use it to complete a registration flow that logs them into the victim's account. This is fixed in version 2.14.5.
Affected products
- Penpot Penpot < 2.14.5
Timeline
- 2026-05-06: patched: Fixes merged and version 2.14.5 released.
- 2026-05-19: advisory: Security advisory GHSA-4937-35vc-hqjj published.
- 2026-07-15: disclosed: CVE-2026-44986 published to NVD.