The vulnerability allows a file editor who has edit rights on a Penpot file to delete any share‑link linked to that file, regardless of whether the editor created the link. The issue is an access‑control bypass, where the system checks only that the caller can edit the file and not that the caller owns the share‑link. This can be used to revoke external reviewers’ access by deleting the link they use to view the file. The weakness is classified as CWE‑284 (Improper Access Control) and CWE‑639 (Authorization Bypass Through User-Controlled Key).

The defect affects the Penpot design and prototyping platform prior to version 2.18.0. All users of Penpot running an affected version who have edit permissions on a file are susceptible when they know a share‑link UUID.

In the CVSS v3 base score the vulnerability is 5.4, reflecting moderate impact. No EPSS score is available, and the issue is not listed in the CISA KEV catalog, suggesting limited public exploitation. The likely attack vector is internal via the delete‑share‑link RPC; an attacker must first discover or guess a valid share‑link UUID, which could be obtained through enumeration or from prior knowledge. Once the UUID is known, an editor can request deletion, thereby revoking access for any external reviewer. The risk level is moderate, primarily affecting confidentiality and availability of shared resources for temporary reviewers.