Is CVE-2026-113596 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-113596?

CVE-2026-113596 has a CVSS v3 severity of LOW (3.1).

Back

CVE-2026-113596

Description

Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user's project UUID can query the /trpc handler to retrieve publish history, titles, domains, preview images, and latest builds.