CVE-2026-92839 Canva CVE debrief

Who should care

Defenders responsible for Canva Desktop installations, security teams, and incident response teams should be aware of this vulnerability and take necessary actions.

Why it matters

CVE-2026-92839 is a medium-severity vulnerability in Canva Desktop before v1.125.0, caused by double decoding in the deeplink handler, which could allow a threat actor to load arbitrary same-origin content under the user's session. Defenders should prioritize verifying the vulnerability status of Canva Desktop installations and ensuring they are updated to a fixed version.

• Verify Canva Desktop installations and ensure they are updated to a fixed version to prevent potential exploitation
• Monitor for potential exploitation attempts to detect possible attacks
• Review and update incident response plans to address potential security incidents

Technical summary

The vulnerability is caused by double decoding in the deeplink handler of Canva Desktop before v1.125.0, which could allow a threat actor to load arbitrary same-origin content under the user's session. This vulnerability has a CVSS score of 4.3, indicating a medium severity level. The vulnerability affects Canva Desktop installations and defenders should prioritize verifying the vulnerability status of Canva Desktop installations and ensuring they are updated to a fixed version.

Defensive priority

Defenders should prioritize verifying the vulnerability status of Canva Desktop installations and ensuring they are updated to a fixed version.

Recommended defensive actions

• Verify Canva Desktop installations and ensure they are updated to a fixed version
• Monitor for potential exploitation attempts
• Review and update incident response plans

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability, with the NVD entry currently listed as Deferred. The vulnerability has a CVSS score of 4.3 and is classified as medium severity. The CVE record was published on 2026-09-17T04:18:10.870Z and has not been modified since then. The NVD entry is also Deferred, indicating that further information may be needed to fully assess the vulnerability. Defenders should verify the vulnerability status of Canva Desktop.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.