CVE-2026-47068 Cross-session PubSub topic injection via URL parameter in phoenix_storybook
Attackers can inject their process into victim sessions via URL parameters, allowing them to intercept or manipulate private playground messages in Phoenix Storybook.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-47068?
CVE-2026-47068 is a low-severity missing authorization vulnerability in phenixdigital phoenix_storybook, published on 20 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Authorization Bypass Through User-Controlled Key vulnerability in phenixdigital phoenix_storybook allows cross-session PubSub topic injection via a URL query parameter.
'Elixir.PhoenixStorybook.Story.ComponentIframeLive':handle_params/3 in lib/phoenix_storybook/live/story/component_iframe_live.ex reads a PubSub topic directly from params["topic"] and broadcasts {:component_iframe_pid, self()} on it with no check that the topic belongs to the requesting session. The shared PhoenixStorybook.PubSub is used to coordinate playground LiveViews with their iframes: a playground subscribes to a session-specific topic and uses the received iframe pid to direct subsequent control messages (variation state, theme switches, extra-assign payloads) via send/2. Because the iframe trusts the query parameter, an attacker who loads /storybook/iframe/<story>?topic=<victim_topic> causes their iframe process pid to be announced on the victim's topic. The victim's playground then addresses its private messages to the attacker's iframe process.
This issue affects phoenix_storybook from 0.4.0 before 1.1.0.
Weakness: CWE-639
Which versions are affected by CVE-2026-47068?
3 open source packages ship an affected version, including phoenix_storybook.
| Package | Affected | Fixed in |
|---|---|---|
phoenix_storybook Hex | From 0.4.0 | 1.1.0 |
phoenix_storybook Hex | From 0.4.0 | 1.1.0 |
phoenix_storybook Hex | From 0.4.0 | 1.1.0 |
How do I fix CVE-2026-47068?
Upgrade phoenix_storybook to 1.1.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-47068 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-47068 exists.
Sources
Also known as EEF-CVE-2026-47068, GHSA-mrhx-6pw9-q5fh.