{"id":"CVE-2026-52850","title":"Docmost is open-source collaborative wiki and documentation software","summary":"Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace member who does not belong to a private space can call the transclusion / sync-block lookup API with a known sourcePageId a…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-639","CWE-862"],"vendor":"docmost","product":"docmost","affected":["docmost < 0.90.1"],"published":"2026-09-24","updated":"2026-09-24","sourceUpdated":"2026-09-24T19:17:14.060","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-52850","references":[{"url":"https://github.com/docmost/docmost/commit/830b5b4d458a1302f42c8b68bff9ff559f6eb342","label":"security-advisories@github.com"},{"url":"https://github.com/docmost/docmost/releases/tag/v0.90.1","label":"security-advisories@github.com"},{"url":"https://github.com/docmost/docmost/security/advisories/GHSA-5vhf-cgf2-c9cq","label":"security-advisories@github.com"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-24T18:49:36.720Z","slug":"CVE-2026-52850","body":"## Overview\n\nDocmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace member who does not belong to a private space can call the transclusion / sync-block lookup API with a known sourcePageId and transclusionId pair because the lookup does not enforce private space membership before resolving the source page. The API can return confidential sync-block content and source page metadata even though the normal page APIs deny access to the same page. This issue is fixed in version 0.90.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}