CVE-2026-52850 in Docmost
Summary
by MITRE • 09/24/2026
Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace member who does not belong to a private space can call the transclusion / sync-block lookup API with a known sourcePageId and transclusionId pair because the lookup does not enforce private space membership before resolving the source page. The API can return confidential sync-block content and source page metadata even though the normal page APIs deny access to the same page. This issue is fixed in version 0.90.1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified in Docmost prior to version 0.90.1 represents a critical authorization failure within the application's API layer, specifically affecting authenticated users who lack membership privileges for private workspaces. As an open-source collaborative wiki and documentation platform, Docmost relies on strict access control mechanisms to segregate data between public and private spaces. The core technical flaw lies in the implementation of the transclusion sync-block lookup endpoint. While standard page retrieval APIs correctly enforce workspace membership checks before returning content, this specific API endpoint fails to validate whether the authenticated user is a member of the source space associated with the requested resource. This inconsistency creates an authorization bypass where the application resolves and returns data based solely on the existence of valid identifiers rather than verifying the requester's permissions against those resources.
From a technical perspective, the issue stems from missing access control checks during the resolution phase of the transclusion mechanism. Transclusion allows content to be embedded or linked across different pages within a workspace. The API endpoint responsible for looking up these sync-blocks accepts parameters such as sourcePageId and transclusionId but does not cross-reference these identifiers with the user's assigned roles or group memberships in private spaces. Consequently, an attacker who possesses valid authentication credentials can construct requests targeting specific internal page IDs and transclusion identifiers. Because the system trusts the structural integrity of these identifiers without validating the contextual permission boundaries, it proceeds to fetch and return sensitive data that should otherwise be restricted by the platform's security model.
The operational impact of this vulnerability is significant for organizations relying on Docmost for confidential documentation management. An authenticated workspace member who does not belong to a private space can exploit this flaw to exfiltrate confidential sync-block content and source page metadata. This constitutes an unauthorized information disclosure, allowing attackers to access proprietary business logic, internal strategies, or sensitive personal data stored within restricted areas of the wiki. The ability to retrieve metadata alongside actual content further aids in reconnaissance efforts, potentially revealing structural details about how private spaces are organized, which could facilitate more targeted attacks against other parts of the system. This behavior directly violates the principle of least privilege and fails to enforce proper object-level access controls.
This vulnerability aligns with CWE-269, Improper Privilege Management, as it involves a failure to properly assign or verify user privileges before granting access to protected resources. It also maps closely to CWE-862, Missing Authorization, since the application does not perform an authorization check for this specific API endpoint despite requiring authentication. In terms of offensive security frameworks, this behavior is characteristic of ATT&CK technique T1078, Valid Accounts, where attackers leverage legitimate credentials to access resources they are not authorized to view. The exploitation path resembles horizontal privilege escalation or lateral movement within the application's data model, as it allows a user in one context (a public space) to read data from another restricted context (a private space).
To mitigate this vulnerability, organizations running Docmust must upgrade immediately to version 0.90.1 or later, where the developers have implemented the necessary access control checks within the transclusion sync-block lookup API. Until an upgrade is feasible, administrators should monitor logs for unusual patterns of API calls involving non-existent or unauthorized page IDs if such logging capabilities are enabled in their deployment environment. Furthermore, it is advisable to review other custom integrations or third-party plugins that might interact with similar endpoints to ensure they do not inadvertently expose this same weakness. Regular security audits and penetration testing focused on authorization bypasses can help identify similar inconsistencies across the application's API surface before they are exploited by malicious actors.