Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.9
CVE-2026-105687: Penpot admin can lock out team owner
CVE-2026-105687 · published 1 month ago
Summary
In Penpot versions before 2.18.0, a team administrator who is not the owner could remove the owner from the team. This would prevent the owner from accessing the team’s projects and assets. Upgrade to Penpot 2.18.0 or later to stop this from happening.
Original advisory text
Penpot: A team admin (non-owner) can remove the team owner via ::delete-team-member — missing owner-protection
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team administrator to remove any member other than themselves but does not protect the team owner. A non-owner administrator can delete the owner's team-profile-rel membership and lock the owner out of the team and its projects, files, fonts, and media. This issue is fixed in version 2.18.0.
References
- https://github.com/penpot/penpot/releases/tag/2.18.0 URL
- https://github.com/penpot/penpot/security/advisories/GHSA-j83r-hph3-xpxc Vendor Advisory
- https://github.com/penpot/penpot/commit/45f0153e8fb1d9b70f2cb121b15780ba2c2085c4 Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-1056... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-105687 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-269Improper Privilege Management
CWE-863Incorrect Authorization
Timeline
Published5 Oct 2026
Updated3 Nov 2026
First seen5 Oct 2026
Track software like this
Free during beta