EUVD-2026-86387Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Impact | This is a genuine but low-severity information-disclosure flaw, correctly rated at CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). All signals point to modest real-world risk: the vector is network-reachable and low-complexity, but exploitation requires an authenticated workspace member (PR:L) and yields only limited confidentiality impact (C:L) with no integrity or availability effect. No EPSS score, no CISA KEV listing, and no public proof-of-concept are present in the provided data, so there is no evidence of active or automated exploitation. The realistic threat is an insider or a compromised low-privilege account within a workspace enumerating private-space content they were not meant to see - a targeted trust-boundary violation rather than a mass-exploitable vulnerability. CWE-639 (Authorization Bypass Through User-Controlled Key / IDOR) is the accurate weakness class; note the input Tag 'Authentication Bypass' is imprecise because the attacker is already authenticated and the flaw is an authorization/access-control gap, not an authentication bypass. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Authenticated workspace members in Docmost prior to 0.90.1 can read confidential sync-block content from private spaces via the transclusion/sync-block lookup API, which fails to enforce private space membership before resolving the source page. This authorization bypass through user-controlled key (CWE-639) is rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), reflecting low confidentiality impact. No public exploit code has been identified at time of analysis.
RemediationAI
Upgrade to Docmost version 0.90.1 or later. The patch is available via the commit 830b5b4d458a1302f42c8b68bff9ff559f6eb342 and the release tag v0.90.1. The vendor advisory at https://github.com/docmost/docmost/security/advisories/GHSA-5vhf-cgf2-c9cq should be consulted for any additional guidance. No specific compensating controls are documented for this issue; restricting API access or monitoring for unusual transclusion lookups could serve as temporary mitigations but would not fully address the bypass.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Docmost uses a transclusion system that stores sync-block content keyed by sourcePageId and transclusionId pairs. The lookup API in the transclusion service resolves the source page directly from these identifiers without verifying that the requesting user is a member of the private space that contains the page. CWE-639 (Authorization Bypass Through User-Controlled Key) describes exactly this class: the attacker supplies a known key pair (sourcePageId, transclusionId) that they do not have authorization to access. The commit 830b5b4d458a1302f42c8b68bff9ff559f6eb342 removes the prior transclusion service specification and presumably adds the missing PageAccessService check. All versions of Docmost before 0.90.1 are affected per the CPE string cpe:2.3:a:docmost:docmost:*:*:*:*:*:*:*:*.
Know when Docmost gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace member who does not belong to a private space can call the transclusion / sync-block lookup API with a known sourcePageId and transclusionId pair because the lookup does not enforce private space membership before resolving the source page. The API can return confidential sync-block content and source page metadata even though the normal page APIs deny access to the same page. This issue is fixed in version 0.90.1.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated path traversal in Docmost v0.21.0's avatar attachment endpoint allows remote attackers to read arbitrary
Stored XSS in Docmost before version 0.25.0 allows authenticated attackers to inject malicious scripts into public share
Docmost versions 0.21.0 through 0.23.x contain a path traversal vulnerability in the zip import feature that allows auth
Stored XSS in Docmost 0.3.0-0.23.2 allows authenticated users to execute arbitrary JavaScript in the browsers of documen
Arbitrary local file and directory deletion on Docmost deployments that use local storage, exploitable by any authentica
Uncontrolled archive extraction in Docmost 0.21.0 through 0.95.0 lets any authenticated workspace member who holds edit
Docmost versions 0.3.0 through 0.70.x allow authenticated users with low privileges to overwrite arbitrary attachments b
Stored cross-site scripting in Docmost's comment system allows authenticated users to plant javascript: URI hyperlinks t
Stored cross-site scripting (XSS) in Docmost prior to version 0.71.0 allows authenticated users to inject malicious `jav
Unauthenticated path traversal in Docmost versions prior to 0.80.1 allows a remote attacker to read files from local sto
Workspace ADMIN accounts in Docmost prior to 0.90.1 can mint OWNER-level accounts through the workspace invitation flow,
Stored cross-site scripting (XSS) in Docmost prior to version 0.70.0 allows authenticated attackers to inject malicious
Exploit-DB