CVE-2026-92800: Docs before 5.4.1 Stale Collaboration Session After Access Revocation
Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can retain real-time read and write access to sub-documents through open websocket sessions that are never disconnected.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments running Docs before 5.4.1 are affected when users collaborate through websocket sessions on sub-documents and their access can be revoked at a parent-document level.
What does an attacker need to exploit it?
The attacker needs prior authorized access that has been revoked, plus an already-open websocket collaboration session. The issue does not describe exploitation by an unauthenticated user or by a user without an existing session.
How can I tell whether access revocation has failed?
After revoking a user's access at a parent document, check whether that user's existing websocket session remains connected and can still read or write associated sub-documents in real time.
What should be prioritized if an immediate upgrade is not possible?
Prioritize terminating existing websocket collaboration sessions for users whose access has been revoked, since the described impact depends on sessions that remain open after revocation.