CVE-2026-59262CWE-862broken-access-control

CVE-2026-59262

Medium · published July 8, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
34.7
In the wild
Unconfirmed
What it is

AFFiNE's histories GraphQL field fails to validate Doc.Read permission before exposing document edit history, allowing authenticated workspace members to retrieve restricted content timelines. Attackers can supply arbitrary document GUIDs to access full edit histories including user names, emails, and timestamps of private pages they lack access to.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00415 · 34.7th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-07-08T20:16Z
References (5)
https://github.com/toeverything/AFFiNE · [email protected]https://github.com/toeverything/AFFiNE/commit/1f0bcd01a37a522393fc1b288395e3a72a79ccad · [email protected]https://github.com/toeverything/AFFiNE/issues/15179 · [email protected]https://www.vulncheck.com/advisories/affine-unauthorized-document-edit-history-access-via-graphql-histories-field · [email protected]https://github.com/toeverything/AFFiNE/issues/15179 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 08 JUL 15:44Z
    AFFiNE - Unauthorized Document Edit History Access via GraphQL histories Field
    cvelistv5