CVE-2026-59262: AFFiNE Information Disclosure Flaw

CVE-2026-59262 Overview

CVE-2026-59262 is a broken access control vulnerability in AFFiNE, an open-source knowledge base and collaboration platform. The histories GraphQL resolver fails to enforce Doc.Read permission before returning document edit history. Authenticated workspace members can query arbitrary document GUIDs and retrieve full edit timelines for pages they do not have permission to view.

The exposed data includes editor names, email addresses, and modification timestamps for private documents. The flaw is classified as Missing Authorization [CWE-862] and impacts the workspace resolver defined in packages/backend/server/src/core/workspaces/resolvers/history.ts.

Critical Impact
Any authenticated workspace member can enumerate document GUIDs and extract private edit histories, exposing user identities, emails, and activity patterns from restricted pages.

Affected Products

AFFiNE (self-hosted and cloud deployments) prior to the patched commit
AFFiNE backend server packages/backend/server GraphQL API
Workspaces relying on the vulnerable histories resolver for access control

Discovery Timeline

2026-07-08 - CVE-2026-59262 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-59262

Vulnerability Analysis

AFFiNE exposes a GraphQL schema where the WorkspaceType resolver includes a histories field. This field returns DocHistoryType records for a document identified by a guid argument. In the vulnerable implementation, the resolver validates that the caller is a member of the workspace but does not check whether the caller holds Doc.Read permission on the specific document.

AFFiNE supports per-document access control, allowing workspace owners to restrict pages to specific collaborators. The missing authorization check breaks this boundary. Any workspace member can pass a document GUID belonging to a restricted page and receive its complete revision history.

The returned DocHistoryType includes the editor's display name, email address, and timestamp for each revision. This exposes both content collaboration metadata and personally identifiable information tied to internal activity.

Root Cause

The resolver did not accept a CurrentUser parameter or invoke the document permission service. Authorization was implicitly delegated to workspace membership, which is a coarser boundary than the per-document ACL AFFiNE enforces elsewhere. The vulnerability is a classic case of Missing Authorization [CWE-862] at the field-resolver layer of a GraphQL API.

Attack Vector

An authenticated attacker with any role in the target workspace crafts a GraphQL query against the histories field, supplying the GUID of a restricted document. GUIDs may be obtained through URL leaks, shared links, prior access, or enumeration. The server returns the full edit history without verifying Doc.Read.

typescript

// Security patch adding CurrentUser and permission enforcement
// packages/backend/server/src/core/workspaces/resolvers/history.ts

  @ResolveField(() => [DocHistoryType])
  async histories(
+    @CurrentUser() user: CurrentUser,
     @Parent() workspace: WorkspaceType,
     @Args('guid') guid: string,
     @Args({ name: 'before', type: () => GraphQLISODateTime, nullable: true })

Source: AFFiNE commit 1f0bcd0. The patch introduces the current user context so the resolver can enforce Doc.Read before returning history records.

Detection Methods for CVE-2026-59262

Indicators of Compromise

GraphQL requests targeting the histories field with document GUIDs that do not appear in the caller's prior page access logs.
Unusual volumes of histories queries from a single authenticated session enumerating multiple GUIDs.
Access log entries where a user retrieves history for documents but never opened the corresponding page endpoint.

Detection Strategies

Enable verbose GraphQL query logging on the AFFiNE backend and alert on histories operations issued by non-owner accounts.
Correlate histories GUIDs with the document ACL table to identify queries against documents the caller lacks Doc.Read on.
Baseline normal editor activity per workspace and flag accounts that query history for documents they never edited or viewed.

Monitoring Recommendations

Ship AFFiNE application and reverse-proxy logs to a centralized SIEM for GraphQL operation analysis.
Track authentication events alongside GraphQL field usage to attribute anomalous history queries to specific user accounts.
Retain GraphQL audit logs long enough to support retrospective investigation of unauthorized history reads.

How to Mitigate CVE-2026-59262

Immediate Actions Required

Update AFFiNE to a release that includes commit 1f0bcd0 on the history.ts resolver.
Audit GraphQL access logs for prior histories queries and identify any unauthorized reads of restricted documents.
Rotate any credentials or sensitive information that may have been exposed through leaked edit histories.

Patch Information

The upstream fix is available in the AFFiNE repository as commit 1f0bcd01a37a522393fc1b288395e3a72a79ccad, titled "fix: enforce Doc.Read permission on workspace histories field (#15192)." Self-hosted operators should rebuild the backend server from a release containing this commit. Refer to the VulnCheck Security Advisory and the GitHub Issue Discussion for coordination details.

Workarounds

Restrict workspace membership to trusted users until the patched version is deployed, since exploitation requires an authenticated workspace member.
Place the AFFiNE GraphQL endpoint behind a reverse proxy that denies unauthenticated access to the histories operation and rate-limits authenticated callers.
Temporarily remove sensitive content from shared workspaces and move it to isolated workspaces with tightly controlled membership.

bash

# Example: pin AFFiNE backend to a patched commit when building from source
git clone https://github.com/toeverything/AFFiNE.git
cd AFFiNE
git checkout 1f0bcd01a37a522393fc1b288395e3a72a79ccad
yarn install
yarn build