CVE-2026-52853: Docmost Privilege Escalation Vulnerability

CVE-2026-52853 Overview

CVE-2026-52853 is a privilege escalation vulnerability in Docmost, an open-source collaborative wiki and documentation platform. Versions prior to 0.90.1 fail to enforce a role ceiling in the workspace invitation flow. An authenticated workspace ADMIN can invite an external email address and assign the OWNER role, granting privileges above the ADMIN's own level. When the invitation is accepted, the new account receives OWNER-level permissions on the workspace. This allows an ADMIN to create a backdoor OWNER account or elevate a colluding external user to the highest workspace privilege. The weakness is classified as Improper Privilege Management [CWE-269] and is fixed in Docmost 0.90.1.

Critical Impact
A compromised or malicious workspace ADMIN can silently promote any invited external account to OWNER, bypassing the intended role hierarchy and gaining durable administrative control over the workspace.

Affected Products

Docmost versions prior to 0.90.1
Self-hosted Docmost deployments using the workspace invitation feature
Docmost instances with multiple ADMIN-level accounts

Discovery Timeline

2026-09-24 - CVE-2026-52853 published to NVD
2026-09-24 - Last updated in NVD database
Fix released - Docmost v0.90.1 published on GitHub containing the role ceiling enforcement

Technical Details for CVE-2026-52853

Vulnerability Analysis

Docmost implements a role hierarchy where OWNER sits above ADMIN, which in turn sits above MEMBER. The invitation handler accepts an arbitrary role parameter from the requesting user without validating that the requested role is less than or equal to the inviter's own role. As a result, an ADMIN account can submit an invitation request that assigns the OWNER role to an external email address. The server persists the invitation with the elevated role, and upon acceptance the new user gains OWNER permissions on the workspace. The flaw is a server-side authorization gap, not a client-only control, so direct API calls reproduce the behavior even if the UI hides the OWNER option.

Root Cause

The root cause is missing enforcement of a role ceiling in the invitation service. The authorization check verifies that the caller holds a management role but does not compare the requested target role against the caller's role. This is an instance of Improper Privilege Management [CWE-269], where a lower-privileged administrator can grant privileges above their own.

Attack Vector

Exploitation requires an authenticated ADMIN account and user interaction from the invited party, who must accept the invitation. The attacker sends an invitation to an attacker-controlled external email with the OWNER role selected. After acceptance, the attacker controls an OWNER account that can modify billing, remove other owners, change workspace settings, and access all workspace content.

text

// Patch references from the fix in v0.90.1
// Source: https://github.com/docmost/docmost/commit/33895b060790358869f54ae451c3848480b39503

// apps/client/public/locales/en-US/translation.json
+  "now": "now",

// apps/client/src/components/ui/destination-picker/destination-picker-modal.tsx
-import { Modal, Button, Group } from "@mantine/core";
+import { Modal, Button, Group, Divider } from "@mantine/core";

The linked commit contains the broader bug-fix bundle shipped in v0.90.1. For the server-side authorization change that enforces the role ceiling, review the full diff in GitHub Pull Request #2250 and the GitHub Security Advisory GHSA-84fx-mvqx-p5gx.

Detection Methods for CVE-2026-52853

Indicators of Compromise

Workspace audit log entries showing an ADMIN account issuing invitations with the OWNER role.
New OWNER accounts created from external email domains that were not previously associated with the workspace.
Sudden increase in the number of OWNER-level users on a workspace shortly after ADMIN activity.
OWNER accounts that have never signed in from a corporate network or SSO identity provider.

Detection Strategies

Query the Docmost database or audit log for invitation events where role = OWNER and the inviter's role was ADMIN at the time of invitation.
Alert on any transition that results in a workspace having more OWNER accounts than approved by governance policy.
Correlate invitation API calls (POST to the workspace invitation endpoint) with the requesting user's effective role.

Monitoring Recommendations

Continuously track the roster of OWNER accounts per workspace and alert on additions.
Forward Docmost application logs to a centralized logging platform and build a detection for OWNER role grants that did not originate from an existing OWNER account.
Review historical invitation records back to the earliest log retention window to identify any OWNER accounts created by ADMIN users before patching.

How to Mitigate CVE-2026-52853

Immediate Actions Required

Upgrade all Docmost instances to version 0.90.1 or later without delay.
Audit every workspace for OWNER accounts and revoke any that cannot be tied to an authorized owner.
Rotate credentials and session tokens for suspicious OWNER accounts and remove any API keys they created.
Review the invitation history and remove pending invitations that specify the OWNER role from non-OWNER inviters.

Patch Information

The fix is included in Docmost 0.90.1, which enforces that an inviter cannot assign a role higher than their own. See the GitHub Release v0.90.1, the merged change in GitHub Pull Request #2250, and the GitHub Security Advisory GHSA-84fx-mvqx-p5gx for the complete remediation details.

Workarounds

Restrict ADMIN role assignments to a minimal set of trusted operators until the patch is applied.
Disable self-service invitations at the reverse proxy or application layer, requiring OWNER approval for new user onboarding.
Place the Docmost invitation endpoint behind an authorization proxy that validates the requested role against the caller's role.

bash

# Example: upgrade a Docker-based Docmost deployment to the patched release
docker compose pull docmost
docker compose down
docker compose up -d

# Verify the running version is 0.90.1 or later
docker inspect --format '{{ .Config.Image }}' docmost