CVE-2026-48073 Overview
CVE-2026-48073 is an access control vulnerability in Docmost, an open-source collaborative wiki and documentation platform. The flaw affects versions 0.70.0 through 0.80.0 and allows a low-privileged authenticated user to retrieve attachments from pages they are not authorized to view. By embedding a forged attachmentId referencing a restricted page in a page they can edit, an attacker triggers the export flow with includeAttachments=true to pull the protected file into the resulting ZIP archive. The issue is tracked as [CWE-639: Authorization Bypass Through User-Controlled Key] and is fixed in version 0.80.1.
Critical Impact
Authenticated users can exfiltrate attachments from restricted pages within the same space, bypassing the direct file download access controls.
Affected Products
- Docmost versions 0.70.0 through 0.80.0
- Self-hosted Docmost deployments using the page export feature
- Multi-tenant Docmost workspaces with mixed-permission pages in shared spaces
Discovery Timeline
- 2026-09-24 - CVE CVE-2026-48073 published to NVD
- 2026-09-24 - Last updated in NVD database
Technical Details for CVE-2026-48073
Vulnerability Analysis
The vulnerability resides in Docmost's page export pipeline. When a user requests an export with includeAttachments=true, the server resolves each referenced attachmentId from the page content and reads the corresponding file from storage. The export handler trusts the attachment references embedded in the page body without re-validating that the requesting user has permission to read the underlying attachment through its parent page's access controls.
An attacker with edit rights to any exportable page in a space can insert attachment references pointing to files owned by restricted pages in the same space. The export operation then packages the restricted files into the ZIP archive returned to the attacker. This path produces attachment disclosure even though the standard file download endpoint correctly denies direct access to the same resources.
Root Cause
The root cause is inconsistent authorization enforcement between the direct attachment download route and the page export route. The download controller checks page-level permissions before serving a file, while the export flow iterates attachments referenced in the page content and reads them from storage without the equivalent permission check. This is a classic Insecure Direct Object Reference pattern mapped to [CWE-639].
Attack Vector
Exploitation requires an authenticated account with edit access to at least one exportable page in a space that also contains restricted pages. The attacker modifies the editable page content to reference a known or guessed attachmentId belonging to a restricted page, then invokes the export API with includeAttachments=true. The returned archive contains the restricted attachment.
// Patch excerpt: apps/server/src/core/attachment/attachment.controller.ts
import { TokenService } from '../auth/services/token.service';
import { JwtAttachmentPayload, JwtType } from '../auth/dto/jwt-payload';
import * as path from 'path';
+import { sanitize } from 'sanitize-filename-ts';
import { AttachmentInfoDto, RemoveIconDto } from './dto/attachment.dto';
import { PageAccessService } from '../page/page-access/page-access.service';
import { AuditEvent, AuditResource } from '../../common/events/audit-events';
Source: GitHub Commit a573ace
Detection Methods for CVE-2026-48073
Indicators of Compromise
- Page export API requests with includeAttachments=true that return archives containing attachment IDs not previously referenced on the exported page.
- Edits to pages that insert attachment references pointing to files whose original parent page the editing user cannot read.
- Unusual volume of export operations from a single low-privileged account across multiple pages in a shared space.
Detection Strategies
- Correlate attachment IDs included in exported ZIP archives against the parent page ACL of the requesting user, flagging mismatches.
- Review Docmost audit logs for repeated page edits followed immediately by export requests from the same account.
- Alert on export operations where the number of attachments exceeds the attachments originally uploaded to the source page.
Monitoring Recommendations
- Enable and centralize Docmost application logs, including export and attachment access events, in a SIEM or data lake.
- Monitor outbound bandwidth from the Docmost server for anomalous export archive sizes correlated to low-privileged users.
- Track changes to space membership and page permissions to identify accounts that were briefly granted edit rights.
How to Mitigate CVE-2026-48073
Immediate Actions Required
- Upgrade all Docmost instances to version 0.80.1 or later without delay.
- Audit recent page exports for unauthorized attachment inclusions, especially in spaces that mix restricted and non-restricted pages.
- Review and tighten edit permissions in spaces that contain sensitive restricted pages.
Patch Information
The fix is published in Docmost 0.80.1. See the GitHub Release v0.80.1, the GitHub Security Advisory GHSA-rxm9-xp9h-4c84, and the remediation GitHub Commit a573ace for implementation details.
Workarounds
- Disable the page export feature for low-privileged roles until the upgrade is applied.
- Separate restricted content into dedicated spaces that do not share membership with lower-trust editors.
- Restrict edit rights on exportable pages to users already authorized to access all attachments within the space.
# Upgrade Docmost via Docker Compose
docker compose pull
docker compose up -d
# Verify running version
docker exec docmost sh -c 'cat package.json | grep version'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
