Executive Summary

CVE-2026-50885 is a vulnerability in Sismics Docs (Teedy) version 1.11 that allows unauthorized attackers to access sensitive data through the share-based read endpoints.

The issue arises because the application merges the untrusted "share" query parameter into the access control list (ACL) target evaluation for read endpoints.

An attacker who knows a valid document or file identifier can bypass read authorization by using reserved administrator target values like "admin" or "administrators" in the share parameter.

This bypasses ACL checks, granting access to protected data such as document metadata, comments, attachments, exported PDFs, and file contents without requiring a valid share token or authentication.

The vulnerability occurs because the system appends the raw share value to the ACL target list and skips ACL checks when these reserved strings are present.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive documents and files stored in Sismics Docs (Teedy) version 1.11.

Attackers can view document metadata, comments, attachments, exported PDFs, and file contents without proper authorization or authentication.

Such unauthorized access can result in data leakage, loss of confidentiality, and potential exposure of sensitive or private information.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to access sensitive endpoints of Sismics Docs (Teedy) v1.11 using crafted requests that include the "share" query parameter with reserved administrator target values such as "admin" or "administrators".

For example, you can try sending HTTP requests to document view, file download, export, or comment listing endpoints with the share parameter set to these reserved values and observe if access is granted without proper authorization.

A sample curl command to test this might be:

• curl -v "http://<target-host>/document/view?id=<document_id>&share=admin"
• curl -v "http://<target-host>/file/download?id=<file_id>&share=administrators"

If these requests return sensitive data without requiring authentication or a valid share token, the vulnerability is present.

Useful 0 Not Useful 0