CVE-2026-52850

Name of the Vulnerable Software and Affected Versions Docmost versions prior to 0.90.1

Description An authenticated workspace member who is not a member of a private space can access confidential content and source page metadata. This occurs because the transclusion / sync-block lookup API does not verify private space membership before resolving the source page. An attacker can exploit this by providing a known sourcePageId and transclusionId pair to the API, bypassing the access restrictions enforced by standard page APIs.

Recommendations Update to version 0.90.1.