Live › vulnerability › CVE-2026-113596
Go to dashboardWebstudio before 0.256.0 lacks an authorization check on the publishedBuilds and findManyByIds tRPC procedures. A logged-in user who knows another user's project UUID can read that project's publish history, titles, domains, preview images and latest builds.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Webstudio before 0.256.0 where more than one user has an account on the same instance. Single-user installs have less exposure because the attacker must be another authenticated user who knows a project UUID. Teams already on or later are not affected.
0.256.0No product ranges from the sources yet.
0.256.0 are affected0.256.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user's project UUID can query the /trpc handler to retrieve publish history, titles, domains, preview images, and latest builds.
This page as .md · .json · in your agent: get_signal("CVE-2026-113596")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.