CVE-2026-33146
Authorization Bypass in Docmost Wiki Exposes Confidential Content
Publication date: 2026-04-14
Last updated on: 2026-04-23
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| docmost | docmost | From 0.70.0 (inc) to 0.70.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Docmost, an open-source collaborative wiki and documentation software, specifically in versions 0.70.0 through 0.70.2. It is an authorization bypass flaw that allows unauthenticated users to access restricted child page titles and text snippets via the public search endpoint (`POST /api/search/share-search`). This means that content meant to be hidden from public viewers can be enumerated and retrieved without proper authorization.
How can this vulnerability impact me? :
The impact of this vulnerability is a confidentiality breach. Unauthorized users can access restricted information that should not be publicly visible, potentially exposing sensitive or private content. This could lead to information leakage and compromise the privacy of the data stored within the affected Docmost instances.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade Docmost to version 0.70.3 or later, which contains the patch addressing the authorization bypass issue.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability leads to a confidentiality breach by allowing unauthenticated users to access restricted content that should remain hidden. Such unauthorized disclosure of information could potentially impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding sensitive information and preventing unauthorized access.
However, specific impacts on compliance depend on the nature of the data exposed and the regulatory context in which the software is used.