CVE-2026-52853 - Docmost: Privilege Escalation - ADMIN Can Invite Users as OWNER

Back Back to CVE browser

MEDIUM

Docmost: Privilege Escalation - ADMIN Can Invite Users as OWNER

Published Sep 24, 2026

5.2

MEDIUM

CVSS 3.1

EPSS 0.21%

Description

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspace invitation flow to invite an external email address with the OWNER role because the role ceiling does not prevent ADMIN users from granting privileges above their own. When the invitation is accepted, the new account receives OWNER-level permissions, allowing the ADMIN to create a backdoor OWNER account or promote a colluding external user to the workspace's highest privilege level. This issue is fixed in version 0.90.1.

Affected products

Vendor Docmost Product Docmost Default
n/a
- Version
  < 0.90.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Docmost

n/a

Version	Status	Constraints
< 0.90.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-269

Improper Privilege Management

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-86391
Advisory
https://github.com/docmost/docmost/commit/33895b060790358869f54ae451c3848480b39503
x_refsource_MISC
https://github.com/docmost/docmost/pull/2250
x_refsource_MISC
https://github.com/docmost/docmost/releases/tag/v0.90.1
x_refsource_MISC
https://github.com/docmost/docmost/security/advisories/GHSA-84fx-mvqx-p5gx
x_refsource_CONFIRM

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-86391		Advisory
https://github.com/docmost/docmost/commit/33895b060790358869f54ae451c3848480b39503		x_refsource_MISC
https://github.com/docmost/docmost/pull/2250		x_refsource_MISC
https://github.com/docmost/docmost/releases/tag/v0.90.1		x_refsource_MISC
https://github.com/docmost/docmost/security/advisories/GHSA-84fx-mvqx-p5gx		x_refsource_CONFIRM