CVE-2026-34213
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Docmost is open-source collaborative wiki and documentation software. In versions from 0.3.0 to 0.71.0, improper authorization allows a low-privileged authenticated user to overwrite another page's attachment within the same workspace by supplying a victim attachmentId to POST /api/files/upload. This is a remote integrity issue requiring no victim interaction. Version 0.71.0 contains a patch.
Risk Assessment
The risk involves the ability to overwrite other users' attachments, potentially leading to data loss or injection of malicious content.
Recommendation
It is recommended to upgrade to version 0.71.0 or later.
Original NVD description (English source)
Docmost is open-source collaborative wiki and documentation software. Starting in version 0.3.0 and prior to version 0.71.0, improper authorization in Docmost allows a low-privileged authenticated user to overwrite another page's attachment within the same workspace by supplying a victim `attachmentId` to `POST /api/files/upload`. This is a remote integrity issue requiring no victim interaction. Version 0.71.0 contains a patch.