CVE-2026-52853

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspace invitation flow to invite an external email address with the OWNER role because the role ceiling does not prevent ADMIN users from granting privileges above their own. When the invitation is accepted, the new account receives OWNER-level permissions, allowing the ADMIN to create a backdoor OWNER account or promote a colluding external user to the workspace's highest privilege level. This issue is fixed in version 0.90.1.

• CWE-269

• https://github.com/docmost/docmost/commit/33895b060790358869f54ae451c3848480b39503
• https://github.com/docmost/docmost/pull/2250
• https://github.com/docmost/docmost/releases/tag/v0.90.1
• https://github.com/docmost/docmost/security/advisories/GHSA-84fx-mvqx-p5gx

Published

Sep 24, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-52845Caddy is an extensible server platform that uses TLS by defa…8.1
• CVE-2026-52846Caddy is an extensible server platform that uses TLS by defa…4.2
• CVE-2026-5285Use after free in WebGL in Google Chrome prior to 146.0.7680…8.8
• CVE-2026-52850Docmost is open-source collaborative wiki and documentation …4.3
• CVE-2026-52851Traccar is an open source GPS tracking system. Prior to 6.14…7.1
• CVE-2026-52852Traccar is an open source GPS tracking system. Prior to 6.14…6.5
• CVE-2026-52854Maps is a MediaWiki extension that enables visualization of …8.6
• CVE-2026-52855Wings is the server control plane for Pterodactyl, a free, o…9.9
• CVE-2026-52856Wings is the server control plane for Pterodactyl, a free, o…7.5
• CVE-2026-52857Wings is the server control plane for Pterodactyl, a free, o…5.5
• CVE-2026-52858Vim is an open source, command line text editor. Prior to ve…7.8
• CVE-2026-52859Vim is an open source, command line text editor. Prior to ve…8.2