CVE-2026-113596CWE-639

CVE-2026-113596

Low · published October 20, 2026

CVSS v3.1
3.1
EPSS
0%
Percentile
20.2
In the wild
Unconfirmed
What it is

Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user's project UUID can query the /trpc handler to retrieve publish history, titles, domains, preview images, and latest builds.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
2.3 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00287 · 20.2th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-10-20T20:17Z
References (6)
https://github.com/webstudio-is/webstudio/issues/5621 · [email protected]https://github.com/webstudio-is/webstudio/releases/tag/0.256.0 · [email protected]https://www.vulncheck.com/advisories/webstudio-before-0.256.0-information-disclosure-via-trpc-publishedbuilds-and-findmanybyids · [email protected]https://github.com/webstudio-is/webstudio/blob/0.255.0/packages/dashboard/src/db/projects.ts · [email protected]https://github.com/webstudio-is/webstudio/blob/0.255.0/packages/project/src/trpc/project-router.ts · [email protected]https://github.com/webstudio-is/webstudio/commit/348d049ed2763d2b6c3e00319fa9086ca67c8aa6 · [email protected]
EPSS history
Timeline
  • 22 OCT 03:29Z
    EPSS moved — → 0%
    epss
  • 20 OCT 15:40Z
    Webstudio before 0.256.0 Information Disclosure via tRPC publishedBuilds and findManyByIds
    cvelistv5
  • 20 OCT 15:40Z
    Webstudio before 0.256.0 Information Disclosure via tRPC publishedBuilds and findManyByIds
    cvelistv5