« Volver al listado

CVE-2026-47068

Estado: AplazadaBaja (2.3)—

Authorization Bypass Through User-Controlled Key vulnerability in phenixdigital phoenix_storybook allows cross-session PubSub topic injection via a URL query parameter.

'Elixir.PhoenixStorybook.Story.ComponentIframeLive':handle_params/3 in lib/phoenix_storybook/live/story/component_iframe_live.ex reads a PubSub topic directly from params["topic"] and broadcasts {:component_iframe_pid, self()} on it with no check that the topic belongs to the requesting session.

Leer descripción completaMostrar menos

The shared PhoenixStorybook.PubSub is used to coordinate playground LiveViews with their iframes: a playground subscribes to a session-specific topic and uses the received iframe pid to direct subsequent control messages (variation state, theme switches, extra-assign payloads) via send/2. Because the iframe trusts the query parameter, an attacker who loads /storybook/iframe/<story>?topic=<victim_topic> causes their iframe process pid to be announced on the victim's topic. The victim's playground then addresses its private messages to the attacker's iframe process.

This issue affects phoenix_storybook from 0.4.0 before 1.1.0.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Phenixdigital — Phoenix StorybookAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-47068",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-47068",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-21T13:59:23.206364Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 2.3,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "PASSIVE",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*"
          ],
          "repo": "https://github.com/phenixdigital/phoenix_storybook",
          "vendor": "phenixdigital",
          "modules": [
            "'Elixir.PhoenixStorybook.Story.ComponentIframeLive'"
          ],
          "product": "phoenix_storybook",
          "versions": [
            {
              "status": "affected",
              "version": "0.4.0",
              "lessThan": "1.1.0",
              "versionType": "semver"
            }
          ],
          "packageURL": "pkg:hex/phoenix_storybook",
          "packageName": "phoenix_storybook",
          "programFiles": [
            "lib/phoenix_storybook/live/story/component_iframe_live.ex"
          ],
          "collectionURL": "https://repo.hex.pm",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "'Elixir.PhoenixStorybook.Story.ComponentIframeLive':handle_params/3"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*"
          ],
          "repo": "https://github.com/phenixdigital/phoenix_storybook",
          "vendor": "phenixdigital",
          "modules": [
            "'Elixir.PhoenixStorybook.Story.ComponentIframeLive'"
          ],
          "product": "phoenix_storybook",
          "versions": [
            {
              "status": "affected",
              "version": "8c2c97b0f505780fee4069988bf86736f51d35d7",
              "lessThan": "6ee03f1c738d4436dde1b066cf65c80663d489f5",
              "versionType": "git"
            }
          ],
          "packageURL": "pkg:github/phenixdigital/phoenix_storybook",
          "packageName": "phenixdigital/phoenix_storybook",
          "programFiles": [
            "lib/phoenix_storybook/live/story/component_iframe_live.ex"
          ],
          "collectionURL": "https://github.com",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "'Elixir.PhoenixStorybook.Story.ComponentIframeLive':handle_params/3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-05-20T14:17:01.557",
  "references": [
    {
      "url": "https://cna.erlef.org/cves/CVE-2026-47068.html",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/phenixdigital/phoenix_storybook/commit/6ee03f1c738d4436dde1b066cf65c80663d489f5",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-mrhx-6pw9-q5fh",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-47068",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-mrhx-6pw9-q5fh",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Authorization Bypass Through User-Controlled Key vulnerability in phenixdigital phoenix_storybook allows cross-session PubSub topic injection via a URL query parameter.\n\n'Elixir.PhoenixStorybook.Story.ComponentIframeLive':handle_params/3 in lib/phoenix_storybook/live/story/component_iframe_live.ex reads a PubSub topic directly from params[\"topic\"] and broadcasts {:component_iframe_pid, self()} on it with no check that the topic belongs to the requesting session. The shared PhoenixStorybook.PubSub is used to coordinate playground LiveViews with their iframes: a playground subscribes to a session-specific topic and uses the received iframe pid to direct subsequent control messages (variation state, theme switches, extra-assign payloads) via send/2. Because the iframe trusts the query parameter, an attacker who loads /storybook/iframe/<story>?topic=<victim_topic> causes their iframe process pid to be announced on the victim's topic. The victim's playground then addresses its private messages to the attacker's iframe process.\n\nThis issue affects phoenix_storybook from 0.4.0 before 1.1.0."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de elusión de autorización mediante clave controlada por el usuario en phenixdigital phoenix_storybook permite la inyección de temas PubSub entre sesiones a través de un parámetro de consulta de URL.\n\n'Elixir.PhoenixStorybook.Story.ComponentIframeLive':handle_params/3 en lib/phoenix_storybook/live/story/component_iframe_live.ex lee un tema PubSub directamente de params[\"topic\"] y transmite {:component_iframe_pid, self()} en él sin ninguna comprobación de que el tema pertenezca a la sesión solicitante. El PhoenixStorybook.PubSub compartido se utiliza para coordinar los LiveViews del playground con sus iframes: un playground se suscribe a un tema específico de la sesión y utiliza el pid del iframe recibido para dirigir mensajes de control posteriores (estado de variación, cambios de tema, cargas útiles de asignación extra) a través de send/2. Debido a que el iframe confía en el parámetro de consulta, un atacante que carga /storybook/iframe/<story>?topic=<victim_topic> hace que el pid de su proceso de iframe sea anunciado en el tema de la víctima. El playground de la víctima entonces dirige sus mensajes privados al proceso de iframe del atacante.\n\nEste problema afecta a phoenix_storybook desde 0.4.0 antes de 1.1.0."
    }
  ],
  "lastModified": "2026-07-23T12:10:00.110",
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
}