CVE-2026-52850

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace member who does not belong to a private space can call the transclusion / sync-block lookup API with a known sourcePageId and transclusionId pair because the lookup does not enforce...

EUVD-2026-86387

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace member who does not belong to a private space can call the transclusion / sync-block lookup API with a known sourcePageId and transclusionId pair because the lookup does not enforce...

CVE-2026-52850: Authorization Bypass Through User-Controlled Key

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace member who does not belong to a private space can call the transclusion / sync-block lookup API with a known sourcePageId and transclusionId pair because the lookup does not enforce...

PT-2026-98239

Name of the Vulnerable Software and Affected Versions Docmost versions prior to 0.90.1 Description An authenticated workspace member who is not a member of a private space can access confidential content and source page metadata. This occurs because the transclusion / sync-block lookup API does n...