CVE-2026-33146
Received Received - Intake
Authorization Bypass in Docmost Wiki Exposes Confidential Content

Publication date: 2026-04-14

Last updated on: 2026-04-23

Assigner: GitHub, Inc.

Description
Docmost is open-source collaborative wiki and documentation software. An authorization bypass vulnerability in versions 0.70.0 through 0.70.2 exposes restricted child page titles and text snippets through the public search endpoint (`POST /api/search/share-search`) for publicly shared content. This flaw allows unauthenticated users to enumerate and retrieve content that should remain hidden from public share viewers, leading to a confidentiality breach. Version 0.70.3 contains a patch.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-14
Last Modified
2026-04-23
Generated
2026-06-16
AI Q&A
2026-04-15
EPSS Evaluated
2026-06-15
NVD
CVE-2026-33146
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
docmost docmost From 0.70.0 (inc) to 0.70.3 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in Docmost, an open-source collaborative wiki and documentation software, specifically in versions 0.70.0 through 0.70.2. It is an authorization bypass flaw that allows unauthenticated users to access restricted child page titles and text snippets via the public search endpoint (`POST /api/search/share-search`). This means that content meant to be hidden from public viewers can be enumerated and retrieved without proper authorization.

Impact Analysis

The impact of this vulnerability is a confidentiality breach. Unauthorized users can access restricted information that should not be publicly visible, potentially exposing sensitive or private content. This could lead to information leakage and compromise the privacy of the data stored within the affected Docmost instances.

Mitigation Strategies

To mitigate this vulnerability, upgrade Docmost to version 0.70.3 or later, which contains the patch addressing the authorization bypass issue.

Compliance Impact

This vulnerability leads to a confidentiality breach by allowing unauthenticated users to access restricted content that should remain hidden. Such unauthorized disclosure of information could potentially impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding sensitive information and preventing unauthorized access.

However, specific impacts on compliance depend on the nature of the data exposed and the regulatory context in which the software is used.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-33146. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart