CVE-2026-85697 Details

A vulnerability in Documenso version 2.17.0 allows low-privilege users to access restricted documents through the PDF-serving endpoint. The issue arises because the endpoint does not properly validate document visibility settings, enabling unauthorized access to documents within the same team or across different tenants. This flaw exploits the absence of ownership verification for document data identifiers, potentially leading to the disclosure of confidential signed documents.

The vulnerability can be addressed by modifying the access control checks in the PDF-serving endpoint to include proper validation of document visibility settings. Additionally, ownership verification should be implemented for document data identifiers to prevent cross-tenant access.