CVE-2026-47068 Details
Description
Authorization Bypass Through User-Controlled Key vulnerability in phenixdigital phoenix_storybook allows cross-session PubSub topic injection via a URL query parameter. 'Elixir.PhoenixStorybook.Story.ComponentIframeLive':handle_params/3 in lib/phoenix_storybook/live/story/component_iframe_live.ex reads a PubSub topic directly from params["topic"] and broadcasts {:component_iframe_pid, self()} on it with no check that the topic belongs to the requesting session. The shared PhoenixStorybook.PubSub is used to coordinate playground LiveViews with their iframes: a playground subscribes to a session-specific topic and uses the received iframe pid to direct subsequent control messages (variation state, theme switches, extra-assign payloads) via send/2. Because the iframe trusts the query parameter, an attacker who loads /storybook/iframe/<story>?topic=<victim_topic> causes their iframe process pid to be announced on the victim's topic. The victim's playground then addresses its private messages to the attacker's iframe process. This issue affects phoenix_storybook from 0.4.0 before 1.1.0.
A vulnerability in the Phenixdigital Phoenix Storybook library, specifically in versions 0.4.0 prior to 1.1.0, allows for cross-session PubSub topic injection through a URL query parameter. The issue arises in the 'Elixir.PhoenixStorybook.Story.ComponentIframeLive' module, where the 'handle_params/3' function reads a PubSub topic directly from the parameters without verifying if it belongs to the requesting session. This flaw enables an attacker to hijack the communication between a playground LiveView and its iframe by injecting their own iframe process ID into a victim's session-specific topic, disrupting the intended message flow.
Users can upgrade to Phoenix Storybook version 1.1.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 20, 2026CISA-ADP
Assessed May 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-mrhx-6pw9-q5fh | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://cna.erlef.org/cves/CVE-2026-47068.html | EEF | Advisory |
| https://github.com/phenixdigital/phoenix_storybook/commit/6ee03f1c738d4436dde1b066cf65c80663d489f5 | EEF | Source CodeVendor |
| https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-mrhx-6pw9-q5fh | EEF | AdvisoryExploitRemedyVendor |
| https://osv.dev/vulnerability/EEF-CVE-2026-47068 | EEF | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | EEF |
Affected Products
| Product | Versions |
|---|---|
| phenixdigital phoenix_storybook | >= 0.4.0, < 1.1.0 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | EEF |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 21, 2026 | CVE Modified | CISA-ADP |
| May 20, 2026 | New CVE Received | EEF |