The Webstudio application has a missing authorization check that lets a logged‑in user query tRPC procedures and retrieve data belonging to other users. Knowing a target project UUID, an attacker can request publish history, project titles, domain names, preview images, and the most recent build details. Because the data is read‑only, the direct impact is the disclosure of project metadata, not code or credentials.

All installations of webstudio‑is webstudio older than version 0.256.0 are affected. The vulnerable routes are the publishedBuilds and findManyByIds procedures exposed through the /trpc endpoint. Users of the dashboard and project packages can trigger the exploit by supplying an arbitrary project UUID to those handlers.

The exploit requires the attacker to be authenticated and to know the target project’s UUID. No elevated privileges are needed beyond normal user access, so the threat is limited to the information that is exposed. The CVSS score of 2.3 reflects a low severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog, and no public exploit is known, but the missing authorization check makes it trivial to perform the read once the required identifiers are obtained.