What is the CVSS score of CVE-2026-50885?

CVE-2026-50885 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Sismics Docs (Teedy) are affected by CVE-2026-50885?

Sismics Docs (Teedy) v1.11 contains an access control vulnerability (CVSS 7.5) that permits unauthenticated remote access to sensitive documents, creating direct exposure of confidential business…

How to fix or mitigate CVE-2026-50885?

Within 24 hours: Inventory all Teedy v1.11 instances across the organization, restrict network access to internal networks only, and disable document-sharing features if operationally feasible. Within 7 days: Deploy Web Application Firewall rules to block requests to vulnerable share endpoints, implement detailed access logging with alerting for anomalous document retrieval, and contact Sismics directly for security patch release timeline. Within 30 days: Deploy the patched Teedy version upon vendor release (version TBD pending advisory), or complete migration to an alternative document management solution; verify all document endpoints enforce proper authentication and access controls.

Sismics Docs (Teedy) CVE-2026-50885

EUVD-2026-36783 HIGH

Improper Access Control (CWE-284)

2026-06-15 mitre

GHSA-9qcp-5m5x-695g

Authentication Bypass N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Share endpoints are network-reachable and unauthenticated per the description, exploitation is straightforward, and the flaw discloses documents only - no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 15:34 vuln.today

CVSS changed

Jun 16, 2026 - 15:22 NVD

7.5 (HIGH)

CVE Published

Jun 15, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Incorrect access control in the share-based read endpoints of Sismics Docs (Teedy) v1.11 allow unauthorized attackers to access sensitive endpoints via a crafted request.

AnalysisAI

Unauthorized information disclosure in Sismics Docs (Teedy) v1.11 allows remote attackers to bypass access controls on share-based read endpoints and retrieve sensitive document data via crafted requests. The flaw stems from broken access control logic (CWE-284) on endpoints intended for shared documents, enabling unauthenticated retrieval of resources that should be restricted. There is no public exploit identified at time of analysis, EPSS is low (0.15%), and the vulnerability is not listed in CISA KEV.

Technical ContextAI

Sismics Docs, also known as Teedy, is an open-source document management system (DMS) written in Java that allows users to organize, tag, and share documents, including via shareable read-only links. The vulnerability is classified as CWE-284 (Improper Access Control), meaning the share-based read endpoints fail to properly verify whether the requesting principal is authorized for the requested resource - likely missing checks that bind the share token to specific document IDs or scopes. Because Teedy exposes a REST API over HTTP(S), the affected endpoints are reachable network-wide whenever the application is deployed, and CPE data in NVD is incomplete (listed only as 'n/a:n/a'), so exact product matching in vulnerability scanners may not work until NVD enriches the record.

RemediationAI

No vendor-released patch identified at time of analysis; defenders should monitor the Sismics Docs project (github.com/sismics/docs) for a release newer than v1.11 and upgrade as soon as one is published, and consult the NVD advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-50885 for updates. In the interim, restrict network exposure of Teedy by placing it behind a VPN or authenticating reverse proxy so the share endpoints are not reachable from the public internet (trade-off: legitimate external share links will stop working), disable or avoid use of the share-link feature until patched, and add WAF or web-server rules to block or tightly rate-limit anonymous requests to share endpoints. Audit existing share links and rotate any tokens, and review access logs for unusual unauthenticated reads against share routes to detect prior abuse.