CVE-2026-52853

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspace invitation flow to invite an external email address with the OWNER role because the role ceiling does not prevent ADMIN users from granting privileges above their own. When the invitation is accepted, the new account receives OWNER-level permissions, allowing the ADMIN to create a backdoor OWNER account or promote a colluding external user to the workspace's highest privilege level. This issue is fixed in version 0.90.1.

CVSS v3 5.2 MEDIUM

5.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/docmost/docmost/commit/33895b060790358869f54ae451c3848480b39503
https://github.com/docmost/docmost/pull/2250
https://github.com/docmost/docmost/releases/tag/v0.90.1
https://github.com/docmost/docmost/security/advisories/GHSA-84fx-mvqx-p5gx

Configurations

No configuration.

History

24 Sep 2026, 19:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-24 19:17

Updated : 2026-10-05 16:17

NVD link : CVE-2026-52853

Mitre link : CVE-2026-52853

CVE.ORG link : CVE-2026-52853

JSON object : View

Products Affected

No product.

CWE

CWE-269

Improper Privilege Management

{"id": "CVE-2026-52853", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-52853", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-05T14:47:00.477232Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 0.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "docmost", "product": "docmost", "versions": [{"status": "affected", "version": "< 0.90.1"}]}]}], "published": "2026-09-24T19:17:14.100", "references": [{"url": "https://github.com/docmost/docmost/commit/33895b060790358869f54ae451c3848480b39503", "source": "security-advisories@github.com"}, {"url": "https://github.com/docmost/docmost/pull/2250", "source": "security-advisories@github.com"}, {"url": "https://github.com/docmost/docmost/releases/tag/v0.90.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/docmost/docmost/security/advisories/GHSA-84fx-mvqx-p5gx", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspace invitation flow to invite an external email address with the OWNER role because the role ceiling does not prevent ADMIN users from granting privileges above their own. When the invitation is accepted, the new account receives OWNER-level permissions, allowing the ADMIN to create a backdoor OWNER account or promote a colluding external user to the workspace's highest privilege level. This issue is fixed in version 0.90.1."}], "lastModified": "2026-10-05T16:17:14.100", "sourceIdentifier": "security-advisories@github.com"}