CVE-2026-85697

Documenso 2.17.0 contains an access control flaw in its PDF-serving endpoint . The route fails to validate document visibility settings, specifically missing ownership validation on document data identifiers , allowing attackers with low privileges to read restricted documents within their team o...

CVE-2026-85697 Documenso 2.17.0 PDF Route Ignores Document Visibility

Documenso 2.17.0 contains an access control vulnerability in the PDF-serving endpoint that fails to validate document visibility settings. Attackers with low privileges can read restricted documents within their team or cross-tenant by leveraging missing ownership validation on document data...

CVE-2025-68386

Improper Authorization CWE-285 in Kibana can lead to privilege escalation CAPEC-233 by allowing an authenticated user to change a document's sharing type to "global," even though they do not have permission to do so, making it visible to everyone in the space via a crafted a HTTP request...