CVE-2026-52850

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace member who does not belong to a private space can call the transclusion / sync-block lookup API with a known sourcePageId and transclusionId pair because the lookup does not enforce private space membership before resolving the source page. The API can return confidential sync-block content and source page metadata even though the normal page APIs deny access to the same page. This issue is fixed in version 0.90.1.

• CWE-639
• CWE-862

• https://github.com/docmost/docmost/commit/830b5b4d458a1302f42c8b68bff9ff559f6eb342
• https://github.com/docmost/docmost/releases/tag/v0.90.1
• https://github.com/docmost/docmost/security/advisories/GHSA-5vhf-cgf2-c9cq

Published

Sep 24, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-52842Lightpanda is a headless browser designed for AI and automat…9.3
• CVE-2026-52843Lightpanda is a headless browser designed for AI and automat…9.3
• CVE-2026-52844Caddy is an extensible server platform that uses TLS by defa…7.5
• CVE-2026-52845Caddy is an extensible server platform that uses TLS by defa…8.1
• CVE-2026-52846Caddy is an extensible server platform that uses TLS by defa…4.2
• CVE-2026-5285Use after free in WebGL in Google Chrome prior to 146.0.7680…8.8
• CVE-2026-52851Traccar is an open source GPS tracking system. Prior to 6.14…7.1
• CVE-2026-52852Traccar is an open source GPS tracking system. Prior to 6.14…6.5
• CVE-2026-52853Docmost is open-source collaborative wiki and documentation …5.2
• CVE-2026-52854Maps is a MediaWiki extension that enables visualization of …8.6
• CVE-2026-52855Wings is the server control plane for Pterodactyl, a free, o…9.9
• CVE-2026-52856Wings is the server control plane for Pterodactyl, a free, o…7.5