Docmost EUVD-2026-86391

Requires an authenticated account holding the workspace ADMIN role and use of the workspace invitation flow to invite an external email address with the OWNER role. Exploitation is LIMITED by: (1) attacker must already possess ADMIN privileges (PR:H) - this is not remotely reachable by an anonymous or low-privilege user; (2) the invited external party must accept the emailed invitation for OWNER permissions to take effect (UI:R). It affects default configurations of Docmost prior to 0.90.1, as the role ceiling is simply absent from the invite privilege check.

This is a genuine but access-gated privilege-escalation flaw (CWE-269), not an inflated high-CVSS finding. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:U) confirms exploitation requires an already-authenticated workspace ADMIN (PR:H) plus the invited party accepting the invitation (UI:R), which sharply limits the population of viable attackers to insiders or a compromised admin account. No EPSS score, no CISA KEV listing, and no public POC are present, so there is no evidence of widespread or automated exploitation - the realistic threat model is a malicious/colluding admin establishing a persistent backdoor OWNER, i.e. targeted insider abuse rather than mass exploitation. The C:H component in the NVD vector is arguably generous given the immediate effect is granting a role; the more precise impact is on integrity/control of the workspace (an OWNER can alter everything), so I lean toward I:H over the input's I:L. Missing signals to note explicitly: no EPSS/KEV/POC data was supplied, and the referenced fix PR diff does not actually contain the role-ceiling enforcement change, so the code-level fix could not be independently verified from the provided evidence.

A workspace administrator (or an attacker who has phished/compromised an admin session) opens the standard invitation flow and invites an external email address, selecting the OWNER role - a level above the admin's own. Because the invite logic never enforces a role ceiling, once that external user accepts the emailed invitation their new account is provisioned with full OWNER privileges, creating a durable backdoor owner or promoting a colluding outsider to the highest workspace tier. No public exploit code is identified; the flaw is trivial to trigger through the normal UI once admin access exists.