CVE-2026-91081

MediumCVSS 5.8

Published: 14/09/2026(UTC)Updated: 23/09/2026(UTC)Translated: 15/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

Docs through version 5.6.1 contains a server-side request forgery (SSRF) vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID. Attackers can exploit DNS time-of-check-time-of-use race conditions and shared address space bypasses to access internal network resources and exfiltrate image content.

Risk Assessment

The vulnerability enables unauthorized access to internal network resources and data exfiltration (e.g., images), potentially leading to confidentiality and integrity breaches.

Recommendation

It is recommended to immediately upgrade Docs to a version newer than 5.6.1 and restrict access to the cors-proxy endpoint, e.g., via authentication or IP filtering.

Other vulnerabilities in Docs

CVE-2026-92800Medium
Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can retain real-time read and write access to sub-documents through open websocket sessions that are never disconnected.

Original NVD description (English source)

Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID. Attackers can exploit DNS time-of-check-time-of-use race conditions and shared address space bypasses to access internal network resources and exfiltrate image content.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS