CVE-2026-52850: Docmost: Broken access control in transclusion lookup API leaks sync-block content across private spaces
Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace member who does not belong to a private space can call the transclusion / sync-block lookup API with a known sourcePageId and transclusionId pair because the lookup does not enforce private space membership before resolving the source page. The API can return confidential sync-block content and source page metadata even though the normal page APIs deny access to the same page. This issue is fixed in version 0.90.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Docmostto a version that resolves this vulnerability.Fixed in 0.90.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Docmost workspace member can exploit it even if they are not a member of the targeted private space. They need a known sourcePageId and transclusionId pair for the protected content.
Are default access controls sufficient to prevent exposure?
No. Normal page APIs may deny access to a private page, but the transclusion or sync-block lookup API can return sync-block content and source-page metadata without enforcing private-space membership.
Which deployments are affected and what is the fix?
Docmost versions prior to 0.90.1 are affected. Upgrade to version 0.90.1, which fixes the missing private-space membership enforcement.
How can I determine whether sensitive content may have been exposed?
Review use of the transclusion or sync-block lookup API by workspace members who were not members of the relevant private spaces, particularly requests involving known sourcePageId and transclusionId pairs. The issue can expose both confidential sync-block content and source page metadata.