CVE-2026-7702: AFFiNE Auth Bypass Vulnerability

CVE-2026-7702 Overview

CVE-2026-7702 is an authorization bypass vulnerability in toeverything AFFiNE versions up to and including 0.26.3. The flaw resides in the allowDocPreview function exposed through the /workspace/:workspaceId/:docId route of the Public Markdown Preview Endpoint. Attackers can manipulate this endpoint remotely without authentication to access documents that should be access-restricted. The exploit is publicly disclosed, increasing the risk of opportunistic abuse. The vendor was contacted prior to disclosure but did not respond. This issue is categorized under CWE-285 Improper Authorization.

Critical Impact
Remote, unauthenticated attackers can bypass authorization checks on the Public Markdown Preview Endpoint to retrieve confidentiality-impacting document content from AFFiNE workspaces.

Affected Products

toeverything AFFiNE versions up to and including 0.26.3
AFFiNE Public Markdown Preview Endpoint component
Self-hosted and cloud AFFiNE deployments exposing /workspace/:workspaceId/:docId

Discovery Timeline

2026-05-03 - CVE-2026-7702 published to the National Vulnerability Database (NVD)
2026-05-05 - Last updated in NVD database
2026-05-07 - EPSS score recorded at 0.03%

Technical Details for CVE-2026-7702

Vulnerability Analysis

The vulnerability is an authorization bypass in the allowDocPreview function within AFFiNE's Public Markdown Preview Endpoint. The endpoint at /workspace/:workspaceId/:docId is intended to render shared markdown documents for public preview when explicitly allowed by the workspace owner. The authorization check fails to properly validate whether a given docId is approved for public preview. As a result, attackers can request arbitrary document identifiers and receive content that should remain private.

The attack requires no authentication, no user interaction, and only network reachability to the AFFiNE instance. Successful exploitation impacts confidentiality of workspace documents but does not directly affect integrity or availability. A public proof-of-concept video demonstrating the bypass is available on GitHub.

Root Cause

The root cause is improper authorization [CWE-285] in the allowDocPreview function. The function does not adequately enforce that the requested document has been explicitly marked as publicly previewable, nor does it verify the relationship between the supplied workspaceId and docId against the configured sharing policy. This permits direct object reference manipulation against the preview route.

Attack Vector

The attack vector is network-based. An attacker enumerates or guesses workspace and document identifiers and issues HTTP requests to /workspace/:workspaceId/:docId. Because the authorization gate is ineffective, the server returns the rendered markdown content. No credentials, tokens, or prior session state are required.

No verified exploitation code has been released by the reporter beyond the demonstration video. See the GitHub PoC Video and VulDB Vulnerability #360871 for additional technical context.

Detection Methods for CVE-2026-7702

Indicators of Compromise

Unauthenticated HTTP GET requests to /workspace/:workspaceId/:docId from external sources at high request rates suggesting enumeration.
Successful 200 OK responses from the preview endpoint for docId values not associated with any documented public-share configuration.
Access log entries showing sequential or randomized docId parameter values originating from a single IP or small IP range.

Detection Strategies

Correlate AFFiNE application logs with workspace sharing configuration to flag preview responses for documents whose allowDocPreview flag is not set.
Deploy web application firewall rules to alert on anomalous request patterns against /workspace/*/* routes lacking authentication headers.
Hunt for prior unauthorized document disclosure by reviewing historical access logs against the published NVD entry CVE-2026-7702.

Monitoring Recommendations

Forward AFFiNE reverse proxy and application logs to a centralized SIEM and create dashboards tracking preview-endpoint request volume and unique docId cardinality per source IP.
Enable alerting on bursts of 4xx-to-2xx ratio shifts on the preview route, which can indicate successful enumeration following failed probes.

How to Mitigate CVE-2026-7702

Immediate Actions Required

Restrict network exposure of AFFiNE instances running version 0.26.3 or earlier behind authenticated reverse proxies until a patched build is available.
Audit existing public share configurations and revoke unnecessary public previews to reduce the volume of legitimate traffic against the affected route.
Review historical access logs for the /workspace/:workspaceId/:docId endpoint to identify possible unauthorized disclosure.

Patch Information

At the time of publication, the vendor toeverything had not responded to the disclosure and no official patch is referenced in the NVD entry. Monitor the AFFiNE GitHub repository for releases newer than 0.26.3 and consult the VulDB Vulnerability #360871 record for updated remediation status.

Workarounds

Place AFFiNE behind an authenticating reverse proxy or VPN so unauthenticated requests cannot reach the Public Markdown Preview Endpoint.
Disable or block the /workspace/:workspaceId/:docId route at the proxy layer if public document sharing is not required by the deployment.
Apply rate limiting and IP reputation filtering to slow enumeration of valid docId values until an upstream fix is published.

bash

# Example NGINX snippet to require authentication on the preview route
location ~ ^/workspace/[^/]+/[^/]+$ {
    auth_request /_auth;
    proxy_pass http://affine_backend;
}