CVE-2026-92800CWE-613

CVE-2026-92800

Medium · published September 17, 2026

CVSS v3.1
6.8
EPSS
0%
Percentile
33.7
In the wild
Unconfirmed
What it is

Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can retain real-time read and write access to sub-documents through open websocket sessions that are never disconnected.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
7.6 · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00406 · 33.7th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2026-09-17T01:17Z
References (5)
https://github.com/geo-chen/oss/blob/main/docs.md · [email protected]https://github.com/suitenumerique/docs · [email protected]https://github.com/suitenumerique/docs/blob/v5.3.0/src/backend/core/api/viewsets.py#L2825-L2860 · [email protected]https://github.com/suitenumerique/docs/commit/d35b81a6ed526dc284c8d0f68b762f2e81ffab13 · [email protected]https://www.vulncheck.com/advisories/docs-before-5.4.1-stale-collaboration-session-after-access-revocation · [email protected]
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 16 SEP 20:32Z
    Docs before 5.4.1 Stale Collaboration Session After Access Revocation
    cvelistv5