{"id":"CVE-2026-52850","published":"2026-09-24T19:17:13.930","lastModified":"2026-09-29T04:17:56.370","description":"Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace member who does not belong to a private space can call the transclusion / sync-block lookup API with a known sourcePageId and transclusionId pair because the lookup does not enforce private space membership before resolving the source page. The API can return confidential sync-block content and source page metadata even though the normal page APIs deny access to the same page. This issue is fixed in version 0.90.1.","cvssScore":4.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cwes":["CWE-639","CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://github.com/docmost/docmost/commit/830b5b4d458a1302f42c8b68bff9ff559f6eb342","tags":[]},{"url":"https://github.com/docmost/docmost/releases/tag/v0.90.1","tags":[]},{"url":"https://github.com/docmost/docmost/security/advisories/GHSA-5vhf-cgf2-c9cq","tags":[]}],"exploitRefs":[{"url":"https://github.com/docmost/docmost/commit/830b5b4d458a1302f42c8b68bff9ff559f6eb342","tags":[]},{"url":"https://github.com/docmost/docmost/releases/tag/v0.90.1","tags":[]},{"url":"https://github.com/docmost/docmost/security/advisories/GHSA-5vhf-cgf2-c9cq","tags":[]}],"hasPoc":true,"ai":null}