CVE-2026-7702

A vulnerability was detected in toeverything AFFiNE up to 0.26.3. This issue affects the function allowDocPreview of the file /workspace/:workspaceId/:docId of the component Public Markdown Preview Endpoint. The manipulation results in authorization bypass. It is possible to launch the attack...

CVE-2026-7702: Authorization Bypass Through User-Controlled Key

A vulnerability was detected in toeverything AFFiNE up to 0.26.3. This issue affects the function allowDocPreview of the file /workspace/:workspaceId/:docId of the component Public Markdown Preview Endpoint. The manipulation results in authorization bypass. It is possible to launch the attack...

Toeverything AFFiNE 授权问题漏洞

Toeverything AFFiNE is an open-source knowledge management software developed by Toeverything. Versions of Toeverything AFFiNE prior to 0.26.3 had an authorization vulnerability. This vulnerability stemmed from the allowDocPreview function in the component Public Markdown Preview Endpoint, which...

CVE-2026-33882: Improper Input Validation

Statamic is a Laravel and Git powered content management system CMS. Prior to versions 5.73.16 and 6.7.2, the markdown preview endpoint could be manipulated to return augmented data from arbitrary fieldtypes. With the users fieldtype specifically, an authenticated control panel user could retriev...