{"id":"CVE-2026-113596","summary":"Webstudio before 0.256.0 Information Disclosure via tRPC publishedBuilds and findManyByIds","details":"Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user's project UUID can query the /trpc handler to retrieve publish history, titles, domains, preview images, and latest builds.","modified":"2026-10-23T10:30:21.731537894Z","published":"2026-10-20T15:40:25.087Z","database_specific":{"cwe_ids":["CWE-639"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113596.json","cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113596.json"},{"type":"PACKAGE","url":"https://github.com/webstudio-is/webstudio"},{"type":"ARTICLE","url":"https://github.com/webstudio-is/webstudio/blob/0.255.0/packages/dashboard/src/db/projects.ts"},{"type":"ARTICLE","url":"https://github.com/webstudio-is/webstudio/blob/0.255.0/packages/project/src/trpc/project-router.ts"},{"type":"FIX","url":"https://github.com/webstudio-is/webstudio/commit/348d049ed2763d2b6c3e00319fa9086ca67c8aa6"},{"type":"REPORT","url":"https://github.com/webstudio-is/webstudio/issues/5621"},{"type":"ADVISORY","url":"https://github.com/webstudio-is/webstudio/releases/tag/0.256.0"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113596"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/webstudio-before-0.256.0-information-disclosure-via-trpc-publishedbuilds-and-findmanybyids"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/webstudio-is/webstudio","events":[{"introduced":"0"},{"fixed":"831aab74d190498e6f3bd93a5259cba327905791"},{"fixed":"348d049ed2763d2b6c3e00319fa9086ca67c8aa6"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"0"},{"fixed":"0.256.0"}]},{"source":"REFERENCES_COMMIT","range":[{"fixed":"348d049ed2763d2b6c3e00319fa9086ca67c8aa6"}]},{"range":[{"fixed":"831aab74d190498e6f3bd93a5259cba327905791"}],"source":"REFERENCES_TAG","original_tag":"0.256.0"}]}}],"versions":["0.250.0","0.237.0","0.231.0","0.229.0","0.228.0","0.227.0","0.226.0","0.225.0","0.223.0","0.222.0","0.221.0","0.220.0","0.215.0","0.201.0","0.191.5","0.191.4","0.191.3","0.191.2","0.191.1","0.189.0","0.188.0","0.187.0","0.185.0","0.184.0","0.183.0","0.179.0","0.175.0","0.174.0","hello14c4aad82030ae12f83796d84cb894362d6c67bd","0.170.0","0.169.0","0.167.0","0.165.0","0.163.0","0.162.0","0.161.0","0.160.0","0.152.0","0.150.0","0.149.0","0.148.0","0.147.0","0.146.0","0.145.0","0.143.0","0.144.0","0.142.0","0.141.0","0.140.0","0.139.0","0.138.0","0.137.0","0.135.0","0.134.0","0.133.0","0.132.0","0.131.0","0.130.0","ccommit","0.129.0","0.128.0","0.127.0","0.126.0","0.125.0","0.124.0","0.123.0","0.122.0","0.121.0","0.120.0","0.119.0","0.118.0","0.117.0","0.116.0","0.115.0","0.114.0","0.113.0","0.112.0","0.111.0","0.110.0","0.109.0","0.107.0","0.106.0","0.105.0","0.104.0","0.103.0","doff","0.100.0","0.96.0","0.93.0","0.91.0","0.90.0","0.89.0","0.88.0","0.87.1","0.87.0","0.86.0","0.85.0","0.84.0","0.83.0","0.82.0","0.81.0","0.80.0","0.79.0","0.78.0","0.77.0","0.76.0","0.75.0","0.74.0","0.73.0","0.72.0","0.71.0","0.70.0","0.69.0","0.68.0","0.67.0","0.66.0","0.65.0","0.64.0","0.63.0","0.62.0","0.61.0","0.60.0","0.59.0","0.58.0","0.57.0","0.56.0","0.55.3","0.55.2","0.55.1","0.55.0","0.54.0","0.52.0","0.51.1","0.51.0","0.50.0","0.49.0","0.48.0","0.47.0","0.46.0","0.45.0","0.44.0","0.43.0","0.42.0","0.41.0","0.40.0","0.39.0","0.38.0","0.37.0","0.36.0","0.35.0","0.34.0","0.33.0","0.32.0","0.31.0","0.30.0","0.29.0","0.28.0","0.27.0","0.26.0","0.25.0","0.24.0","0.23.0","0.22.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-113596.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}]}