CVE-2026-113596 — Webstudio before 0.256.0 Information Disclosure via tRPC publishedBuilds and findManyByIds
Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByI…
Published: 2026-10-20 · CVSS: 2.3 · CVSS 4.0
Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user's project UUID can query the /trpc handler to retrieve publish history, titles, domains, preview images, and latest builds.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7