The delete-team-member RPC in Penpot prior to version 2.18.0 allows a team administrator who is not the owner to delete any member’s team-profile-rel record, including that of the owner. By doing so, the owner can be locked out of the team and all its projects, files, fonts, and media. The weakness is an authorization failure, as defined by CWE-269 and CWE-863, that permits an elevated user to undermine the team’s leadership and access control.

The affected software is Penpot (penpot:penpot). All releases before 2.18.0 are vulnerable; the issue is fixed in 2.18.0 and later.

The CVSS score of 4.9 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting limited evidence of exploitation. The likely attack vector is an internal RPC call that team administrators can invoke, inferred from the description. An attacker must already have team‑administrator privileges, but can still remove the team owner, resulting in loss of control over the entire team’s resources. Although no public exploits have been reported, the moderate risk and potential for significant impact warrant timely remediation.