Trust & Security Portal
Canva is an online digital design and publishing platform that enables individuals, teams, and enterprises to create visual content collaboratively. It supports the creation of a wide range of content, including social media posts, presentations, videos, posters, logos, and websites. With over 220 million monthly active users worldwide, trust, privacy, and security are central to how we operate. Learn more about Canva here - https://www.canva.com/about/.
This Trust & Security Portal provides visibility into Canva’s security posture, privacy practices, compliance commitments, and reliability controls. You can also request access to our security documentation and audit reports through the portal.
Expedia Group
Salesforce
T-Mobile
Stripe
Airbnb
HubSpot
Subprocessors
Subprocessors
CVE-2025-12792
Security Bulletin
Published Date: 13 November 2025
CVE: CVE-2025-12792
Severity: Low
CVSS: 3.2 - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
Affected Products and Versions: The Canva for Mac desktop app before version 1.117.1, released through the Mac App Store. The Canva for Mac desktop app distributed through canva.com is not affected.
Details
The Mac App Store distribution of the Canva for Mac desktop app was built without Hardened Runtime. A local threat actor with unprivileged access could execute arbitrary code that inherits the TCC (Transparency, Consent, and Control) permissions assigned to Canva.
Remediation Advice
Canva recommends users upgrade to the latest version of the Canva application via the Mac App Store.
Acknowledgements
This vulnerability was submitted to Canva's Bug Bounty Program by p1tsi.
