CVE-2026-34213

Description

Docmost is open-source collaborative wiki and documentation software. Starting in version 0.3.0 and prior to version 0.71.0, improper authorization in Docmost allows a low-privileged authenticated user to overwrite another page's attachment within the same workspace by supplying a victim `attachmentId` to `POST /api/files/upload`. This is a remote integrity issue requiring no victim interaction. Version 0.71.0 contains a patch.

PUBLISHED Reserved 2026-03-26 | Published 2026-04-14 | Updated 2026-04-15 | Assigner GitHub_M

Problem types

CWE-639: Authorization Bypass Through User-Controlled Key

Product status

References

github.com/...ocmost/security/advisories/GHSA-89fp-2hch-j9gp

cve.org (CVE-2026-34213)

nvd.nist.gov (CVE-2026-34213)

Download JSON