CVE-2026-33146

MediumCVSS 4.3

Published: 14/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

Docmost open-source collaborative wiki software, versions 0.70.0 through 0.70.2, has an authorization bypass vulnerability in the public search endpoint, allowing unauthenticated users to enumerate and retrieve hidden child page titles and text snippets.

Risk Assessment

Confidentiality breach – unauthorized users can access content that should remain hidden from public share viewers.

Recommendation

Update Docmost to version 0.70.3, which contains a fix for this vulnerability.

Original NVD description (English source)

Docmost is open-source collaborative wiki and documentation software. An authorization bypass vulnerability in versions 0.70.0 through 0.70.2 exposes restricted child page titles and text snippets through the public search endpoint (`POST /api/search/share-search`) for publicly shared content. This flaw allows unauthenticated users to enumerate and retrieve content that should remain hidden from public share viewers, leading to a confidentiality breach. Version 0.70.3 contains a patch.