CVE-2026-52850

4.3 Moyenne

Publiée le 24/09/2026 à 21:17 · Modifiée le 29/09/2026 à 06:17 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace member who does not belong to a private space can call the transclusion / sync-block lookup API with a known sourcePageId and transclusionId pair because the lookup does not enforce private space membership before resolving the source page. The API can return confidential sync-block content and source page metadata even though the normal page APIs deny access to the same page. This issue is fixed in version 0.90.1.

Traduire en français

Produits concernés

docmost

Scores CVSS

Version	Score	Source	Vecteur
3.1	4.3 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N`

Faiblesses (CWE)

CWE-639
CWE-862

Références

https://github.com/docmost/docmost/commit/830b5b4d458a1302f42c8b68bff9ff559f6eb342
https://github.com/docmost/docmost/releases/tag/v0.90.1
https://github.com/docmost/docmost/security/advisories/GHSA-5vhf-cgf2-c9cq

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories