CVE-2026-7702CWE-285CWE-639

toeverything AFFiNE Public Markdown Preview Endpoint :docId allowDocPreview authorization

Medium · published May 3, 2026

CVSS v4.0
6.9
EPSS
1%
Percentile
43.2
In the wild
Unconfirmed
What it is

A vulnerability was detected in toeverything AFFiNE up to 0.26.3. This issue affects the function allowDocPreview of the file /workspace/:workspaceId/:docId of the component Public Markdown Preview Endpoint. The manipulation results in authorization bypass. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00519 · 43.2th percentile
Weaknesses
CWE-285 · Improper Authorization; CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-05-03T15:45Z
EPSS history
Timeline
  • 03 MAY 15:45Z
    toeverything AFFiNE Public Markdown Preview Endpoint :docId allowDocPreview authorization
    cvelistv5