CVE-2026-85697: Documenso Authentication Bypass Vulnerability

CVE-2026-85697 Overview

CVE-2026-85697 is a broken access control vulnerability [CWE-863] in Documenso 2.17.0. The flaw resides in the PDF-serving endpoint, which fails to validate document visibility settings before returning file data. Authenticated attackers with low privileges can retrieve restricted documents belonging to other users within their team or across tenants. Exploitation requires only knowledge of a document data identifier, which is passed to the endpoint without ownership checks. The vulnerability affects the files.helpers.ts handler in the Remix server and is disclosed in GitHub Issue #3112.

Critical Impact
Low-privileged attackers can read confidential PDF documents across team and tenant boundaries by requesting document identifiers directly from the PDF endpoint.

Affected Products

Documenso 2.17.0
Documenso Remix server PDF-serving endpoint (apps/remix/server/api/files/files.helpers.ts)
Multi-tenant Documenso deployments with restricted document visibility settings

Discovery Timeline

2026-09-04 - CVE-2026-85697 published to the National Vulnerability Database (NVD)
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-85697

Vulnerability Analysis

Documenso 2.17.0 exposes a PDF-serving route that resolves document data by identifier and streams the associated file. The route omits authorization logic that would verify whether the requesting user has permission to view the target document. As a result, an attacker who authenticates as any user, including a low-privileged team member, can request arbitrary document identifiers and receive the underlying PDF content.

The issue is a missing authorization check rather than a broken one. Visibility settings such as team-private or owner-only are stored on the document record but never consulted before returning the file. The VulnCheck advisory confirms the endpoint ignores document visibility metadata entirely.

Root Cause

The root cause is an authorization gap in the file-serving helper located at apps/remix/server/api/files/files.helpers.ts. The helper accepts a document data identifier and loads file contents without cross-referencing the caller's session against document ownership, team membership scope, or configured visibility. This pattern maps to CWE-863: Incorrect Authorization. See the Documenso source file for context.

Attack Vector

Exploitation is network-based and requires low privileges but no user interaction. An authenticated attacker enumerates or obtains document data identifiers, then issues direct requests to the PDF endpoint. The server returns document contents regardless of whether the requester is the owner, a permitted team member, or belongs to the same tenant. Confidentiality impact is high; integrity and availability are unaffected.

No public proof-of-concept exploit code is available. Refer to GitHub Issue #3112 and the VulnCheck advisory for reproduction details.

Detection Methods for CVE-2026-85697

Indicators of Compromise

Repeated requests from a single authenticated session to the Documenso PDF-serving endpoint with sequential or enumerated document data identifiers.
Successful HTTP 200 responses returning PDF content to users who are not listed as owners or authorized viewers of the requested document.
Access patterns crossing team or tenant boundaries in Documenso audit logs.

Detection Strategies

Correlate application access logs against document ownership metadata to identify reads where the requester lacks a legitimate visibility grant.
Alert on high-volume PDF endpoint requests from a single account in a short window, indicating identifier enumeration.
Monitor for authenticated users accessing document identifiers they did not create, share, or receive as a signer.

Monitoring Recommendations

Enable verbose logging on the Documenso Remix server for all /api/files route handlers and forward logs to a central SIEM.
Ingest Documenso application and web-server logs into a security data lake for retrospective hunting once the patch is applied.
Track anomalous document-download volume per user account and per team as a baseline behavioral metric.

How to Mitigate CVE-2026-85697

Immediate Actions Required

Upgrade Documenso to a version later than 2.17.0 once the maintainers publish a patched release addressing the visibility check.
Restrict access to the Documenso instance to trusted networks or authenticated users only while a fix is pending.
Audit application logs for prior access to sensitive PDF documents by unexpected user accounts.

Patch Information

At the time of publication, no fixed version was listed in the NVD entry. Monitor the Documenso GitHub repository and GitHub Issue #3112 for patch availability. Apply the update to all Documenso instances, including staging and disaster-recovery environments.

Workarounds

Place the Documenso PDF endpoint behind an authenticating reverse proxy that enforces per-user access rules until a vendor patch is applied.
Rotate document data identifiers where feasible and treat any previously served document as potentially exposed to other tenants.
Reduce the population of low-privileged accounts on shared Documenso deployments to shrink the attacker pool.

bash

# Example reverse-proxy rule (nginx) to restrict PDF endpoint access
location /api/files/ {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://documenso_upstream;
}