PT-2026-42177 · Unknown · Phoenix Storybook

Christian Blavier + 2 · Published 2026-05-20 · Updated 2026-05-20 · CVE-2026-47068

Positive Technologies (AI Summary)

CVSS v4.0

2.3

Low

Base vector

AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions phoenix storybook versions 0.4.0 through 1.0.x

Description An authorization bypass occurs due to user-controlled keys, allowing cross-session PubSub topic injection via a URL query parameter. The function handle params/3 in Elixir.PhoenixStorybook.Story.ComponentIframeLive reads a PubSub topic directly from the topic parameter and broadcasts the iframe process pid without verifying if the topic belongs to the requesting session. This allows an attacker to load the endpoint '/storybook/iframe/' with a topic parameter belonging to a victim, causing the victim's playground to send private control messages, such as variation state and theme switches, to the attacker's iframe process.

Recommendations Update phoenix storybook to version 1.1.0.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-47068

GHSA-MRHX-6PW9-Q5FH

Affected Products

Phoenix Storybook

References · 6

• https://github.com/phenixdigital/phoenix_storybook/commit/6ee03f1c738d4436dde1b066cf65c80663d489f5 · Patch
• https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-mrhx-6pw9-q5fh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-47068 · Security Note
• https://osv.dev/vulnerability/EEF-CVE-2026-47068 · Vendor Advisory
• https://cna.erlef.org/cves/CVE-2026-47068.html · Note
• https://hex.pm/packages/phoenix_storybook · Note