CVE-2026-44986 Penpot: Pre-authenticated account takeover via team-invitation token + prepare-register-profile
Attackers can take over any user account by exploiting invitation token flaws and missing password verification during profile registration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-44986?
CVE-2026-44986 is a critical authentication bypass vulnerability in penpot, published on 15 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Penpot is an open-source design tool for design and code collaboration. Prior to 2.14.5, Penpot exposed teams_invitations.clj invitation tokens from create-team-invitations, embedded an existing profile id in auth.clj prepare-register-profile, and had auth.clj register-profile issue a session based on the invitation email match without password verification, allowing a registered user to take over any non-blocked profile. This issue is fixed in version 2.14.5.
Which versions are affected by CVE-2026-44986?
How do I fix CVE-2026-44986?
No fix has been published for CVE-2026-44986 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-44986 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44986 exists.
Sources
Also known as GHSA-4937-35vc-hqjj.