CVE-2026-47068
Description
Authorization Bypass Through User-Controlled Key vulnerability in phenixdigital phoenix_storybook allows cross-session PubSub topic injection via a URL query parameter. 'Elixir.PhoenixStorybook.Story.ComponentIframeLive':handle_params/3 in lib/phoenix_storybook/live/story/component_iframe_live.ex reads a PubSub topic directly from params["topic"] and broadcasts {:component_iframe_pid, self()} on it with no check that the topic belongs to the requesting session. The shared PhoenixStorybook.PubSub is used to coordinate playground LiveViews with their iframes: a playground subscribes to a session-specific topic and uses the received iframe pid to direct subsequent control messages (variation state, theme switches, extra-assign payloads) via send/2. Because the iframe trusts the query parameter, an attacker who loads /storybook/iframe/<story>?topic=<victim_topic> causes their iframe process pid to be announced on the victim's topic. The victim's playground then addresses its private messages to the attacker's iframe process. This issue affects phoenix_storybook from 0.4.0 before 1.1.0.
How to fix
- phenixdigital phoenix_storybook1.1.0, 6ee03f1c738d4436dde1b066cf65c80663d489f5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| phenixdigital phoenix_storybook | 0.4.0 ≤ v < 1.1.0, 8c2c97b0f505780fee4069988bf86736f51d35d7 ≤ v < 6ee03f1c738d4436dde1b066cf65c80663d489f5 | 1.1.0, 6ee03f1c738d4436dde1b066cf65c80663d489f5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.