CVE-2026-52850

Deferred Deferred - Pending Action

Authenticated Workspace Member Access to Private Sync-Block Content in Docmost

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace member who does not belong to a private space can call the transclusion / sync-block lookup API with a known sourcePageId and transclusionId pair because the lookup does not enforce private space membership before resolving the source page. The API can return confidential sync-block content and source page metadata even though the normal page APIs deny access to the same page. This issue is fixed in version 0.90.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-24

Generated

2026-09-25

AI Q&A

2026-09-25

EPSS Evaluated

N/A

NVD

CVE-2026-52850

EUVD

EUVD-2026-86387

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

Docmost is open-source wiki software. Before version 0.90.1, an authenticated user in a workspace but not in a private space could access confidential content via the transclusion API. The API returned sync-block data and metadata even when normal page access was blocked due to private space restrictions.

Detection Guidance

This vulnerability requires authenticated access to exploit and involves private space content exposure. Check Docmost API logs for unusual transclusion or sync-block lookup requests from non-admin workspace members. Look for requests with sourcePageId and transclusionId parameters that return sensitive data.

Impact Analysis

If you use Docmost versions before 0.90.1, unauthorized users in your workspace could view private space content. This includes sensitive sync-block data and page metadata that should be restricted to private space members only.

Compliance Impact

This vulnerability could lead to unauthorized access to confidential data, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations must ensure private data remains inaccessible to unauthorized users to maintain compliance.

Mitigation Strategies

Upgrade Docmost to version 0.90.1 or later immediately. Review workspace member permissions and restrict private space access to authorized users only. Monitor API logs for suspicious activity related to transclusion or sync-block lookups.

Hi! I’m here to help you understand CVE-2026-52850. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70