CVE-2026-105688: Penpot: Team admin can escalate to owner via team invitation (missing owner-role guard on the invitation path)
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, create-team-invitations and the invitation acceptance path allow a non-owner team administrator to assign the owner role because invitation roles are persisted and applied without the role-ceiling check used by update-team-member-role. An administrator can invite another account as an owner, create multiple owners, and then use the new owner account to obtain owner-only control over the team. This issue is fixed in version 2.18.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Penpotto a version that resolves this vulnerability.Fixed in 2.18.0
Event History
Frequently Asked Questions
Who can exploit this issue?
A non-owner team administrator can exploit it. They must be able to create a team invitation and have another account accept an invitation assigned the owner role.
Are default deployments affected?
The provided information does not identify any configuration prerequisite. The vulnerable invitation creation and acceptance paths are affected in versions prior to 2.18.0.
What is the impact of successful exploitation?
A team administrator can create one or more owner accounts. The newly created owner account can then exercise owner-only control over the team.
How can I determine whether a team may already have been affected?
Review team membership for unexpected owner accounts, especially accounts added through invitations by non-owner administrators. The issue permits multiple owners to be created through the invitation workflow.
What should be done if an immediate upgrade is not possible?
Restrict or closely monitor team administrators' ability to create invitations, and review invitations and owner-role assignments for unauthorized changes. Upgrade to version 2.18.0 when possible.