CVE-2026-42889

Relay adds real-time collaboration to Obsidian. Relay Server versions 0.9.0 through 0.9.6 contain an authentication bypass in the multi-document WebSocket endpoints. When authentication is configured, WebSocket connections without a token query parameter were incorrectly treated as having full server permissions. An unauthenticated network attacker who knows or guesses a document ID could connect to the document sync WebSocket and read or modify document contents without a valid document token. This vulnerability is fixed in 0.9.7.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/No-Instructions/relay-server/security/advisories/GHSA-9vp9-8q9j-8mqm
https://github.com/No-Instructions/relay-server/security/advisories/GHSA-9vp9-8q9j-8mqm

Configurations

No configuration.

History

26 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Relay añade colaboración en tiempo real a Obsidian. Relay Server versiones 0.9.0 a 0.9.6 contienen una omisión de autenticación en los puntos finales WebSocket multidocumento. Cuando la autenticación está configurada, las conexiones WebSocket sin un parámetro de consulta de token fueron tratadas incorrectamente como si tuvieran permisos completos de servidor. Un atacante de red no autenticado que conoce o adivina un ID de documento podría conectarse al WebSocket de sincronización de documentos y leer o modificar el contenido del documento sin un token de documento válido. Esta vulnerabilidad está corregida en 0.9.7.

Information

Published : 2026-05-12 20:16

Updated : 2026-10-26 18:10

NVD link : CVE-2026-42889

Mitre link : CVE-2026-42889

CVE.ORG link : CVE-2026-42889

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

CWE-863

Incorrect Authorization

{"id": "CVE-2026-42889", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42889", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-13T12:32:29.545243Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "No-Instructions", "product": "relay-server", "versions": [{"status": "affected", "version": ">= 0.9.0, < 0.9.7"}]}]}], "published": "2026-05-12T20:16:42.143", "references": [{"url": "https://github.com/No-Instructions/relay-server/security/advisories/GHSA-9vp9-8q9j-8mqm", "source": "security-advisories@github.com"}, {"url": "https://github.com/No-Instructions/relay-server/security/advisories/GHSA-9vp9-8q9j-8mqm", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-639"}, {"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Relay adds real-time collaboration to Obsidian. Relay Server versions 0.9.0 through 0.9.6 contain an authentication bypass in the multi-document WebSocket endpoints. When authentication is configured, WebSocket connections without a token query parameter were incorrectly treated as having full server permissions. An unauthenticated network attacker who knows or guesses a document ID could connect to the document sync WebSocket and read or modify document contents without a valid document token. This vulnerability is fixed in 0.9.7."}, {"lang": "es", "value": "Relay a\u00f1ade colaboraci\u00f3n en tiempo real a Obsidian. Relay Server versiones 0.9.0 a 0.9.6 contienen una omisi\u00f3n de autenticaci\u00f3n en los puntos finales WebSocket multidocumento. Cuando la autenticaci\u00f3n est\u00e1 configurada, las conexiones WebSocket sin un par\u00e1metro de consulta de token fueron tratadas incorrectamente como si tuvieran permisos completos de servidor. Un atacante de red no autenticado que conoce o adivina un ID de documento podr\u00eda conectarse al WebSocket de sincronizaci\u00f3n de documentos y leer o modificar el contenido del documento sin un token de documento v\u00e1lido. Esta vulnerabilidad est\u00e1 corregida en 0.9.7."}], "lastModified": "2026-10-26T18:10:00.173", "sourceIdentifier": "security-advisories@github.com"}