Which versions of AFFiNE are affected by CVE-2026-59262?

AFFiNE workspace collaboration software contains a broken access control vulnerability (CVE-2026-59262) enabling authenticated members to trivially access document edit histories and contributor…. A patch is available.

How to fix or mitigate CVE-2026-59262?

Within 24 hours: Identify all AFFiNE deployments and current versions. Within 7 days: Apply the latest vendor-released patch from toeverything/AFFiNE advisories and verify the GraphQL 'histories' resolver enforces document read permissions. Within 30 days: Audit workspace access logs for unauthorized document history queries and review user accounts with access to sensitive documents.

AFFiNE CVE-2026-59262

Q: What is the CVSS score of CVE-2026-59262?

CVE-2026-59262 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-42314 HIGH

Missing Authorization (CWE-862)

2026-07-08 VulnCheck

GHSA-m4gp-5xh5-xhq4

Authentication Bypass Red Hat Affine Monorepo

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network GraphQL endpoint with a legitimate low-privilege workspace member (PR:L), trivial to trigger (AC:L), and read-only disclosure of history data yields C:H with I:N/A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 16:31 vuln.today

DescriptionCVE.org

AFFiNE's histories GraphQL field fails to validate Doc.Read permission before exposing document edit history, allowing authenticated workspace members to retrieve restricted content timelines. Attackers can supply arbitrary document GUIDs to access full edit histories including user names, emails, and timestamps of private pages they lack access to.

AnalysisAI

Broken access control in AFFiNE (toeverything/AFFiNE monorepo) lets any authenticated workspace member read the edit history of documents they should not access by querying the GraphQL 'histories' field with an arbitrary document GUID. Because the resolver never checks Doc.Read permission, an attacker can enumerate private page timelines and harvest contributor user names, emails, and edit timestamps. No public exploit has been identified at time of analysis, but exploitation is trivial for any low-privileged member.

Technical ContextAI

AFFiNE is an open-source knowledge-base / workspace collaboration platform (a Notion-style docs and whiteboard tool) built as a monorepo with a GraphQL API backend. The flaw is a CWE-862 Missing Authorization: the server-side GraphQL resolver for the 'histories' field returns a document's versioned edit history (a change timeline that Yjs/CRDT-style collaborative editors retain) without first evaluating the workspace's Doc.Read access-control check that gates the document itself. The CPE cpe:2.3:a:affine:monorepo identifies the AFFiNE application codebase as the affected component. Because authorization is enforced only on the primary document-fetch path and not on the history sub-resource, supplying a known or guessed document GUID bypasses the intended per-document permission model while still requiring a valid workspace session.

RemediationAI

Patch available per vendor advisory: apply the upstream fix commit https://github.com/toeverything/AFFiNE/commit/1f0bcd01a37a522393fc1b288395e3a72a79ccad, which adds the missing Doc.Read permission check to the GraphQL histories resolver; a released patched version was not independently confirmed from the provided data, so self-hosters should build from a revision including this commit or track the referenced issue (https://github.com/toeverything/AFFiNE/issues/15179) for a tagged release. As a compensating control until patched, restrict who can join sensitive workspaces and minimize low-trust members (this reduces the pool of accounts able to abuse PR:L access but does not close the hole), and if feasible place the GraphQL API behind an authorizing proxy or WAF rule that blocks or logs 'histories' queries against document GUIDs (trade-off: may break legitimate history/version-restore features for all users). Monitor GraphQL logs for anomalous enumeration of document GUIDs on the histories field as a detective control.