CVE-2026-59262

35th percentile - higher than 35% of all known CVEs

AFFiNE's histories GraphQL field fails to validate Doc.Read permission before exposing document edit history, allowing authenticated workspace members to retrieve restricted content timelines. Attackers can supply arbitrary document GUIDs to access full edit histories including user names, emails, and timestamps of private pages they lack access to.

An attacker can access the full edit history of private pages, including user names, emails, and timestamps, compromising confidentiality and potentially leading to sensitive information disclosure.

Immediately update AFFiNE to a version that fixes the permission validation in the 'histories' GraphQL field. Until then, restrict workspace access to trusted users only.