EEF-CVE-2026-47068 CVE-2026-47068 GHSA-mrhx-6pw9-q5fh

Cross-session PubSub topic injection via URL parameter in phoenix_storybook

Low Hex

Severity: 0.0 / 10; Low · CVSS 4.0
Exploit chance (EPSS): 0.45%; Chance of exploitation in the next 30 days. Higher than 39.04% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-639 Authorization Bypass Through User-Controlled Key
Fix: 1.1.0; Upgrade phoenix_storybook to this version or later

Description

Summary

Authorization Bypass Through User-Controlled Key vulnerability in phenixdigital phoenix_storybook allows cross-session PubSub topic injection via a URL query parameter.

'Elixir.PhoenixStorybook.Story.ComponentIframeLive':handle_params/3 in lib/phoenix_storybook/live/story/component_iframe_live.ex reads a PubSub topic directly from params["topic"] and broadcasts {:component_iframe_pid, self()} on it with no check that the topic belongs to the requesting session. The shared PhoenixStorybook.PubSub is used to coordinate playground LiveViews with their iframes: a playground subscribes to a session-specific topic and uses the received iframe pid to direct subsequent control messages (variation state, theme switches, extra-assign payloads) via send/2. Because the iframe trusts the query parameter, an attacker who loads /storybook/iframe/<story>?topic=<victim_topic> causes their iframe process pid to be announced on the victim's topic. The victim's playground then addresses its private messages to the attacker's iframe process.

This issue affects phoenix_storybook from 0.4.0 before 1.1.0.

Affected versions

Hex

Package	Vulnerable	Fixed in
phoenix_storybook	`>= 0.4.0, < 1.1.0`	`1.1.0`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

phoenix_storybook Hex → `1.1.0`

mix

{:phoenix_storybook, "~> 1.1.0"} # then: mix deps.update phoenix_storybook

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: Present
Privileges required: None
User interaction: Passive
Confidentiality (vulnerable system): Low
Integrity (vulnerable system): Low
Availability (vulnerable system): None
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None

Weakness

CWE-639: Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

How to prevent it

Architecture and Design: For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Architecture and Design, Implementation: Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Architecture and Design: Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.

References

Advisories

Fixes and patches

github.com/phenixdigital/phoenix_storybook/commit/6ee03f1c738d4436dde1b066cf65c…

Packages

Timeline

May 20, 2026 Published
Jul 30, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
EEF-CVE-2026-8467 Unauthenticated remote code execution via HEEx template injection in phoenix_storybook playground	Critical	Also affects phoenix_storybook
EEF-CVE-2026-8469 Unauthenticated denial-of-service via BEAM atom table exhaustion in phoenix_storybook	High	Also affects phoenix_storybook
GHSA-w3p3-7cjg-vgfw Keycloak allows unauthorized access to resources via uma permission ticket bypass	Medium	Same weakness, CWE-639
EEF-CVE-2026-96581 An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records	Not rated yet	Same weakness, CWE-639
GHSA-vwwx-px9w-crrc ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints	Low	Same weakness, CWE-639
GHSA-2jrp-qc93-h2j8 ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization	Medium	Same weakness, CWE-639
GHSA-q6wp-fr43-gm9v Contao: Improper access control in the preview links module	Medium	Same weakness, CWE-639
GHSA-f7hx-52q9-hcrf Payload: Unauthorized update to collection documents	Critical	Same weakness, CWE-639

Credits: Christian Blavier, Jonatan Männchen / EEF, Peter Ullrich

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor