CVE-2026-33146

Received Received - Intake

Authorization Bypass in Docmost Wiki Exposes Confidential Content

Publication date: 2026-04-14

Last updated on: 2026-04-23

Assigner: GitHub, Inc.

Description

Docmost is open-source collaborative wiki and documentation software. An authorization bypass vulnerability in versions 0.70.0 through 0.70.2 exposes restricted child page titles and text snippets through the public search endpoint (`POST /api/search/share-search`) for publicly shared content. This flaw allows unauthenticated users to enumerate and retrieve content that should remain hidden from public share viewers, leading to a confidentiality breach. Version 0.70.3 contains a patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-14

Last Modified

2026-04-23

Generated

2026-07-06

AI Q&A

2026-04-15

EPSS Evaluated

2026-07-05

NVD

CVE-2026-33146

Affected Vendors & Products

Vendor	Product	Version / Range
docmost	docmost	From 0.70.0 (inc) to 0.70.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Docmost, an open-source collaborative wiki and documentation software, specifically in versions 0.70.0 through 0.70.2. It is an authorization bypass flaw that allows unauthenticated users to access restricted child page titles and text snippets via the public search endpoint (`POST /api/search/share-search`). This means that content meant to be hidden from public viewers can be enumerated and retrieved without proper authorization.

Impact Analysis

The impact of this vulnerability is a confidentiality breach. Unauthorized users can access restricted information that should not be publicly visible, potentially exposing sensitive or private content. This could lead to information leakage and compromise the privacy of the data stored within the affected Docmost instances.

Mitigation Strategies

To mitigate this vulnerability, upgrade Docmost to version 0.70.3 or later, which contains the patch addressing the authorization bypass issue.

Compliance Impact

This vulnerability leads to a confidentiality breach by allowing unauthenticated users to access restricted content that should remain hidden. Such unauthorized disclosure of information could potentially impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding sensitive information and preventing unauthorized access.

However, specific impacts on compliance depend on the nature of the data exposed and the regulatory context in which the software is used.

Hi! I’m here to help you understand CVE-2026-33146. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70