CVE-2026-59262

AFFiNE - Unauthorized Document Edit History Access via GraphQL histories Field

CVSS 7.1 HIGHEPSS 0.2%CWE-862

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 7.1EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Lifecycle

08 Jul 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

AFFiNE's histories GraphQL field fails to validate Doc.Read permission before exposing document edit history, allowing authenticated workspace members to retrieve restricted content timelines. Attackers can supply arbitrary document GUIDs to access full edit histories including user names, emails, and timestamps of private pages they lack access to.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Affected products

affine · monorepo

References

https://github.com/toeverything/AFFiNE https://github.com/toeverything/AFFiNE/commit/1f0bcd01a37a522393fc1b288395e3a72a79ccad https://github.com/toeverything/AFFiNE/issues/15179 https://www.vulncheck.com/advisories/affine-unauthorized-document-edit-history-access-via-graphql-histories-field