CVE-2026-52850 - Docmost: Broken access control in transclusion lookup API leaks sync-block content across private spaces

Back Back to CVE browser

MEDIUM

Docmost: Broken access control in transclusion lookup API leaks sync-block content across private spaces

Published Sep 24, 2026

4.3

MEDIUM

CVSS 3.1

EPSS 0.19%

Description

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace member who does not belong to a private space can call the transclusion / sync-block lookup API with a known sourcePageId and transclusionId pair because the lookup does not enforce private space membership before resolving the source page. The API can return confidential sync-block content and source page metadata even though the normal page APIs deny access to the same page. This issue is fixed in version 0.90.1.

Affected products

Vendor Docmost Product Docmost Default
n/a
- Version
  < 0.90.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Docmost

n/a

Version	Status	Constraints
< 0.90.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-639

Authorization Bypass

CWE-862

Missing Authorization

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-86387
Advisory
https://github.com/docmost/docmost/commit/830b5b4d458a1302f42c8b68bff9ff559f6eb342
x_refsource_MISC
https://github.com/docmost/docmost/releases/tag/v0.90.1
x_refsource_MISC
https://github.com/docmost/docmost/security/advisories/GHSA-5vhf-cgf2-c9cq
x_refsource_CONFIRM

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-86387		Advisory
https://github.com/docmost/docmost/commit/830b5b4d458a1302f42c8b68bff9ff559f6eb342		x_refsource_MISC
https://github.com/docmost/docmost/releases/tag/v0.90.1		x_refsource_MISC
https://github.com/docmost/docmost/security/advisories/GHSA-5vhf-cgf2-c9cq		x_refsource_CONFIRM