Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-52850 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace member who does not belong to a private space can call the transclusion / sync-block lookup API with a known sourcePageId and transclusionId pair because the lookup does not enforce private space membership before resolving the source page. The API can return confidential sync-block content and source page metadata even though the normal page APIs deny access to the same page. This issue is fixed in version 0.90.1.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:4.3 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CNA: [email protected]CVSS-B:4.3 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/docmost/docmost/commit/830b5b4d458a1302f42c8b68bff9ff559f6eb342	[email protected]	Source CodeVendor
https://github.com/docmost/docmost/releases/tag/v0.90.1	[email protected]	Release NotesVendor
https://github.com/docmost/docmost/security/advisories/GHSA-5vhf-cgf2-c9cq	[email protected]	AdvisoryRemedyVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-639	Authorization Bypass Through User-Controlled Key	[email protected]
CWE-862	Missing Authorization	[email protected]

Affected Products

Product	Versions
Docmost	0.90.0 (semver)
CPE No CPEs found in CPE dictionary for this product. Remediation Upgrade: 0.90.1moderate efforthttps://github.com/docmost/docmost/releases/tag/v0.90.1

Change History

1 change record found show changes