CVE-2026-52850: Docmost Information Disclosure Vulnerability

CVE-2026-52850 Overview

Docmost is open-source collaborative wiki and documentation software. CVE-2026-52850 is an authorization flaw in Docmost versions prior to 0.90.1. The transclusion and sync-block lookup API fails to enforce private space membership before resolving a source page. An authenticated workspace member who does not belong to a private space can call the API with a known sourcePageId and transclusionId pair and retrieve confidential sync-block content and source page metadata. The normal page APIs correctly deny access to the same page, making this a classic authorization bypass through an alternate API path. The issue is fixed in version 0.90.1.

Critical Impact
Authenticated workspace members can read confidential content from private spaces they do not belong to by querying the transclusion lookup endpoint directly.

Affected Products

Docmost versions prior to 0.90.1
Component: apps/server/src/core/page/transclusion/transclusion.service.ts
Fixed in: Docmost 0.90.1

Discovery Timeline

2026-09-24 - CVE-2026-52850 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-52850

Vulnerability Analysis

The vulnerability is an Insecure Direct Object Reference ([CWE-639]) in the Docmost transclusion service. Docmost supports private spaces that restrict page access to specific members. The main page APIs validate space membership before returning content. However, the sync-block transclusion lookup API resolves pages without applying the same membership check.

An authenticated user who learns a valid sourcePageId and transclusionId pair can invoke the lookup endpoint and receive the referenced sync-block content and source page metadata. The attacker needs valid workspace credentials but does not need to be a member of the targeted private space. The flaw exposes confidentiality of restricted content without affecting integrity or availability.

Root Cause

The transclusion service did not inject or consult a space membership repository before resolving the source page. The patch imports SpaceMemberRepo from @docmost/db/repos/space/space-member.repo and introduces membership enforcement into the lookup path. Prior code paths trusted that any authenticated caller passing a valid identifier pair had legitimate access, which is incorrect for pages located inside private spaces.

Attack Vector

Exploitation requires network access to the Docmost application and valid workspace member credentials. The attacker enumerates or obtains the sourcePageId and transclusionId of content inside a private space, then calls the transclusion lookup endpoint. The server returns sync-block content and source page metadata that would otherwise be denied through the standard page API.

typescript

// Security patch excerpt — transclusion.service.ts
// Source: https://github.com/docmost/docmost/commit/830b5b4d458a1302f42c8b68bff9ff559f6eb342
} from '@nestjs/common';
import { isDeepStrictEqual } from 'node:util';
import { v7 as uuid7 } from 'uuid';
-import { KyselyTransaction } from '@docmost/db/types/kysely.types';
+import { InjectKysely } from 'nestjs-kysely';
+import { KyselyDB, KyselyTransaction } from '@docmost/db/types/kysely.types';
import { PageTransclusionsRepo } from '@docmost/db/repos/page-transclusions/page-transclusions.repo';
import { PageTransclusionReferencesRepo } from '@docmost/db/repos/page-transclusions/page-transclusion-references.repo';
import { PageRepo } from '@docmost/db/repos/page/page.repo';
import { PagePermissionRepo } from '@docmost/db/repos/page/page-permission.repo';
+import { SpaceMemberRepo } from '@docmost/db/repos/space/space-member.repo';
import { AttachmentRepo } from '@docmost/db/repos/attachment/attachment.repo';
import { StorageService } from '../../../integrations/storage/storage.service';

The patch adds SpaceMemberRepo so the service can verify the caller belongs to the private space before returning sync-block content. See the GitHub Security Advisory GHSA-5vhf-cgf2-c9cq for full details.

Detection Methods for CVE-2026-52850

Indicators of Compromise

Requests to the transclusion or sync-block lookup API from authenticated users who are not members of the referenced private space.
Unusual volume of lookup calls containing varying sourcePageId or transclusionId values from a single account, suggesting enumeration.
Access patterns where a workspace member retrieves content from private spaces without corresponding page-view events in the main page API logs.

Detection Strategies

Correlate application logs between the transclusion endpoint and the standard page API; successful transclusion reads without matching authorized page reads indicate the bypass.
Review Docmost server logs for lookup requests referencing pages belonging to private spaces the caller does not join.
Hunt for brute-force enumeration patterns against the transclusion lookup endpoint, particularly sequential or scripted identifier access.

Monitoring Recommendations

Enable verbose logging on the Docmost API gateway or reverse proxy to capture endpoint, user, and parameter metadata.
Forward Docmost application logs to a centralized log platform and build alerts on cross-space access anomalies.
Baseline normal transclusion usage per user and alert on statistical outliers.

How to Mitigate CVE-2026-52850

Immediate Actions Required

Upgrade Docmost to version 0.90.1 or later immediately.
Audit historical access logs for the transclusion lookup endpoint to identify any unauthorized reads of private space content.
Rotate or revoke sensitive content stored in private spaces that may have been exposed to non-member workspace users.

Patch Information

The fix is included in Docmost 0.90.1, released as GitHub Release v0.90.1. The code change is tracked in GitHub Commit 830b5b4, which adds SpaceMemberRepo to the transclusion service and enforces private space membership before resolving a source page.

Workarounds

No official workaround is published; upgrading to 0.90.1 is the recommended remediation.
As a temporary compensating control, restrict workspace membership to trusted users only until the upgrade is applied.
If feasible, block or rate-limit the transclusion lookup endpoint at a reverse proxy for untrusted user groups.

bash

# Example upgrade using Docker Compose
docker compose pull
docker compose up -d

# Verify the running version
docker exec -it docmost sh -c 'cat package.json | grep "\"version\""'