EUVD-2026-22750Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from Vendor (github) · only source for this CVE.
CVSS VectorVendor: github
Lifecycle Timeline
6DescriptionCVE.org
Docmost is open-source collaborative wiki and documentation software. An authorization bypass vulnerability in versions 0.70.0 through 0.70.2 exposes restricted child page titles and text snippets through the public search endpoint (POST /api/search/share-search) for publicly shared content. This flaw allows unauthenticated users to enumerate and retrieve content that should remain hidden from public share viewers, leading to a confidentiality breach. Version 0.70.3 contains a patch.
AnalysisAI
Docmost versions 0.70.0 through 0.70.2 allow unauthenticated users to bypass authorization controls and enumerate restricted child page titles and text snippets via the public search endpoint, exposing confidential documentation content that should only be visible to authorized share viewers. This medium-severity confidentiality breach affects any Docmost instance with publicly shared workspaces and requires user interaction (clicking a link or accessing the search interface), but poses significant risk to organizations treating Docmost as a confidential knowledge base.
Technical ContextAI
Docmost's public share search feature (POST /api/search/share-search) implements insufficient authorization checks when filtering search results for unauthenticated users with access to a share token. The vulnerability stems from a failure to properly enforce content access control boundaries (CWE-285: Improper Authorization) between restricted hierarchical page structures. An unauthenticated attacker with knowledge of a public share URL can directly query the search API endpoint, which returns metadata and snippets for nested pages and restricted content that the public share viewer should not access. The flaw affects Docmost's wiki document hierarchy model, where child pages inherit or are tied to parent page sharing rules, but the search function bypasses these scoping restrictions.
RemediationAI
Vendor-released patch: Docmost 0.70.3 and later. Immediately upgrade all Docmost instances from versions 0.70.0-0.70.2 to 0.70.3 or the latest stable release. If immediate patching is not possible, restrict public share functionality or disable the search endpoint for publicly shared documents until an upgrade can be scheduled. Review audit logs for any evidence of unauthorized search queries against public share endpoints, and audit the contents of publicly shared workspaces to identify if sensitive information was enumerated. For detailed remediation guidance, refer to https://github.com/docmost/docmost/security/advisories/GHSA-qq4c-8rjr-w42c.
Unauthenticated path traversal in Docmost v0.21.0's avatar attachment endpoint allows remote attackers to read arbitrary
Stored XSS in Docmost before version 0.25.0 allows authenticated attackers to inject malicious scripts into public share
Docmost versions 0.21.0 through 0.23.x contain a path traversal vulnerability in the zip import feature that allows auth
Stored XSS in Docmost 0.3.0-0.23.2 allows authenticated users to execute arbitrary JavaScript in the browsers of documen
Docmost versions 0.3.0 through 0.70.x allow authenticated users with low privileges to overwrite arbitrary attachments b
Stored cross-site scripting in Docmost's comment system allows authenticated users to plant javascript: URI hyperlinks t
Stored cross-site scripting (XSS) in Docmost prior to version 0.71.0 allows authenticated users to inject malicious `jav
Stored cross-site scripting (XSS) in Docmost prior to version 0.70.0 allows authenticated attackers to inject malicious
Cross Site Scripting vulnerability in docmost v.0.21.0 and before allows an attacker to execute arbitrary code. Rated me
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today