CVE-2026-47068

published 2026-05-20

CVE-2026-47068: Authorization Bypass Through User-Controlled Key vulnerability in phenixdigital phoenix_storybook allows cross-session PubSub topic injection via a URL query…

Priority P4 15 low 2.3 CVSS 4.0

AV N AC L AT P PR N UI P VC L VI L VA N SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

Authorization Bypass Through User-Controlled Key vulnerability in phenixdigital phoenix_storybook allows cross-session PubSub topic injection via a URL query parameter.

'Elixir.PhoenixStorybook.Story.ComponentIframeLive':handle_params/3 in lib/phoenix_storybook/live/story/component_iframe_live.ex reads a PubSub topic directly from params["topic"] and broadcasts {:component_iframe_pid, self()} on it with no check that the topic belongs to the requesting session. The shared PhoenixStorybook.PubSub is used to coordinate playground LiveViews with their iframes: a playground subscribes to a session-specific topic and uses the received iframe pid to direct subsequent control messages (variation state, theme switches, extra-assign payloads) via send/2. Because the iframe trusts the query parameter, an attacker who loads /storybook/iframe/?topic= causes their iframe process pid to be announced on the victim's topic. The victim's playground then addresses its private messages to the attacker's iframe process.

This issue affects phoenix_storybook from 0.4.0 before 1.1.0.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
phenixdigital	phoenix_storybook	>= 0.4.0 < 1.1.0	1.1.0
phenixdigital	phoenix_storybook	>= 0.4.0 < 1.1.0	1.1.0
phenixdigital	phoenix_storybook	>= 8c2c97b0f505780fee4069988bf86736f51d35d7 < 6ee03f1c738d4436dde1b066cf65c80663d489f5	6ee03f1c738d4436dde1b066cf65c80663d489f5

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-639