The vulnerability lies in the way Penpot’s RPC commands that retrieve comments omit the share link’s page restriction when checking permissions. As a result, anyone holding a page‑scoped share link can fetch the full comment threads, including the comment text, commenter identities, email addresses, photos, and page identifiers from pages that are not part of that share scope. This allows unintended disclosure of internal project information. The weakness is twofold: it represents an information disclosure (CWE‑200) and a bypass of intended access control (CWE‑863).

Affected systems are installations of Penpot prior to version 2.18.0, regardless of deployment environment. The product is the Penpot open‑source design and prototyping platform. All users who are able to receive or construct share links to a page in a Penpot file are potentially in a position to exploit the flaw.

The CVSS score of 4.3 indicates a low‑to‑medium severity. EPSS data is unavailable, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a valid share link, which may be shared by a legitimate user, so the attack vector is likely indirect but achievable. Once the attacker obtains the link, they can issue the vulnerable RPC calls and pull the exposed data without additional privileges. The impact is the exposure of private project details rather than full system compromise.