Authenticated Workspace Owner Privilege Escalation in Docmost

Executive Summary

Docmost is open-source wiki software. Prior to version 0.90.1, an authenticated workspace admin could invite an external user with the OWNER role through the workspace invitation system. The role ceiling did not prevent admins from granting higher privileges than their own, allowing them to create a backdoor OWNER account or elevate a colluding user to the highest permission level.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability requires checking Docmost user roles and workspace invitations. Review workspace member lists for unexpected OWNER role assignments. Check audit logs for invitation events with elevated privileges. Verify Docmost version is 0.90.1 or higher to confirm patch status.

Useful 0 Not Useful 0

Impact Analysis

An attacker with admin access could grant themselves or an accomplice OWNER-level permissions, enabling full control over the workspace. This could lead to unauthorized data access, modification, or deletion, and compromise the entire documentation system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and auditability, such as GDPR's data protection principles or HIPAA's access management rules. Unauthorized privilege escalation risks exposing sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Docmost to version 0.90.1 or later to fix the role ceiling issue. Review all workspace members with OWNER privileges and remove any unauthorized accounts. Audit recent invitations and revoke suspicious ones.

Useful 0 Not Useful 0