EUVD-2026-22756Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Primary rating from Vendor (github) · only source for this CVE.
CVSS VectorVendor: github
Lifecycle Timeline
6DescriptionCVE.org
Docmost is open-source collaborative wiki and documentation software. Starting in version 0.3.0 and prior to version 0.71.0, improper authorization in Docmost allows a low-privileged authenticated user to overwrite another page's attachment within the same workspace by supplying a victim attachmentId to POST /api/files/upload. This is a remote integrity issue requiring no victim interaction. Version 0.71.0 contains a patch.
AnalysisAI
Docmost versions 0.3.0 through 0.70.x allow authenticated users with low privileges to overwrite arbitrary attachments belonging to other users within the same workspace via improper authorization checks on the POST /api/files/upload endpoint. An attacker can supply a victim's attachmentId to modify or corrupt files without user interaction, compromising document integrity across the workspace. No public exploit code has been identified; patch version 0.71.0 is available.
Technical ContextAI
Docmost is a collaborative wiki and documentation platform written in Node.js/TypeScript. The vulnerability stems from CWE-639 (Authorization Bypass Through User-Controlled Key), where the file upload API endpoint fails to properly validate that the authenticated user has permission to modify attachments owned by other users. The API likely uses attachment IDs as direct object references without verifying workspace-level or user-level ownership. The affected versions 0.3.0-0.70.x did not implement adequate access control checks before allowing overwrite operations on existing attachment resources.
RemediationAI
Upgrade Docmost to version 0.71.0 or later immediately. The vendor has released a patched version that implements proper authorization checks on the POST /api/files/upload endpoint to verify user ownership before allowing attachment modifications. Refer to the official GitHub Security Advisory (https://github.com/docmost/docmost/security/advisories/GHSA-89fp-2hch-j9gp) for detailed upgrade instructions. If immediate upgrade is not feasible, temporarily restrict file upload permissions at the application or network level; however, this is not a substitute for patching. Users should review access logs and audit attachment modification history to detect if this vulnerability was exploited during the window before patching.
Unauthenticated path traversal in Docmost v0.21.0's avatar attachment endpoint allows remote attackers to read arbitrary
Stored XSS in Docmost before version 0.25.0 allows authenticated attackers to inject malicious scripts into public share
Docmost versions 0.21.0 through 0.23.x contain a path traversal vulnerability in the zip import feature that allows auth
Stored XSS in Docmost 0.3.0-0.23.2 allows authenticated users to execute arbitrary JavaScript in the browsers of documen
Stored cross-site scripting in Docmost's comment system allows authenticated users to plant javascript: URI hyperlinks t
Stored cross-site scripting (XSS) in Docmost prior to version 0.71.0 allows authenticated users to inject malicious `jav
Stored cross-site scripting (XSS) in Docmost prior to version 0.70.0 allows authenticated attackers to inject malicious
Docmost versions 0.70.0 through 0.70.2 allow unauthenticated users to bypass authorization controls and enumerate restri
Cross Site Scripting vulnerability in docmost v.0.21.0 and before allows an attacker to execute arbitrary code. Rated me
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today