Read the docs
TI-2026-32845 Aliases CVE-2026-44986

Penpot: Pre-authenticated account takeover via team-invitation token + prepare-register-profile

Priority HIGH 76CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

Penpot is an open-source design tool for design and code collaboration. Prior to 2.14.5, Penpot exposed teams_invitations.clj invitation tokens from create-team-invitations, embedded an existing profile id in auth.clj prepare-register-profile, and had auth.clj register-profile issue a session based on the invitation email match without password verification, allowing a registered user to take over any non-blocked profile. This issue is fixed in version 2.14.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00523 44th percentileScored 2026-11-07
Fix Fixed penpot (penpot): 2.14.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
penpotpenpotbefore 2.14.52.14.5Patch availableCNA
  • penpot Vendorpenpot Affected before 2.14.5 Fixed in 2.14.5 Patch available CNA

Remediation

  • Fix · CNA penpot (penpot) Fixed in 2.14.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44986

References

Other 4

  • TI-2026-68335 OS command injection in Penpot SVG exporter via fill color CVSS 3.1CRITICAL 9.9
  • TI-2026-35172 Penpot: Stored XSS via comment content, innerHTML renders unsanitized HTML CVSS 3.1HIGH 8.7
  • TI-2026-33540 Penpot: MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE CVSS 3.1HIGH 8.8
  • TI-2026-14441 Missing authorization in Penpot CVSS 3.1HIGH 7.5
  • TI-2026-33541 Penpot: Authenticated SSRF in remote image import via create-file-media-object-from-url CVSS 3.1HIGH 7.7
  • TI-2026-68333 SSRF guard bypass in Penpot via IPv6 transition addresses CVSS 4.0MEDIUM 6.0
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences