CVE-2026-113596 webstudio-is CVE debrief

Who should care

Defenders responsible for Webstudio deployments, particularly those with multi-user environments, should assess exposure and verify that their instances are updated to version 0.256.0 or later. Authenticated users with project UUID knowledge are at risk of being able to read other users' project data.

Why it matters

CVE-2026-113596 is a low-severity vulnerability in Webstudio before 0.256.0 that allows authenticated users to disclose other users' project data. Defenders should prioritize verifying exposure, assessing potential impact, and updating to the fixed version.

• Potential unauthorized project data access by authenticated users
• Need to verify Webstudio version and update to 0.256.0 or later
• Monitoring of project data access and authentication logs required

Technical summary

The Webstudio application before version 0.256.0 contains a missing authorization vulnerability. This vulnerability allows authenticated users to read other users' project data via the publishedBuilds and findManyByIds tRPC procedures. An attacker who knows another user's project UUID can query the /trpc handler to retrieve publish history, titles, domains, preview images, and latest builds. The vulnerability is particularly concerning in multi-user environments where authenticated users may have knowledge of other users' project UUIDs.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, focusing on authenticated users with project UUID knowledge.

Recommended defensive actions

• Verify Webstudio version and check for updates to 0.256.0 or later
• Restrict access to project UUIDs and tRPC procedures
• Monitor project data access and authentication logs
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the missing authorization vulnerability in Webstudio before 0.256.0, allowing authenticated users to read other users' project data. The vulnerability is caused by a missing authorization check in the publishedBuilds and findManyByIds tRPC procedures. The source item provides additional context on the vulnerability, including its impact and potential mitigations. However, the exact scope of affected systems and potential exploits is not explicitly stated, requiring defenders to verify

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.