CVE-2026-48073

Name of the Vulnerable Software and Affected Versions Docmost versions 0.70.0 through 0.80.0

Description An authenticated user with low privileges who can edit an exportable page can embed a forged attachmentId belonging to a restricted page within the same space. When the page is exported using the includeAttachments=true parameter, the export process reads the restricted attachment from storage and includes it in the resulting ZIP archive, bypassing the access controls that normally deny direct file downloads.

Recommendations Update to version 0.80.1.