CVE-2026-59262

AFFiNE - Unauthorized Document Edit History Access via GraphQL histories Field

CVSS 7.1 HIGHEPSS 0.2%CWE-862

Vexday Risk Score

21Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 7.1EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

08 jul 2026Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

AFFiNE's histories GraphQL field fails to validate Doc.Read permission before exposing document edit history, allowing authenticated workspace members to retrieve restricted content timelines. Attackers can supply arbitrary document GUIDs to access full edit histories including user names, emails, and timestamps of private pages they lack access to.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Productos afectados

affine · monorepo

Referencias

https://github.com/toeverything/AFFiNE https://github.com/toeverything/AFFiNE/commit/1f0bcd01a37a522393fc1b288395e3a72a79ccad https://github.com/toeverything/AFFiNE/issues/15179 https://www.vulncheck.com/advisories/affine-unauthorized-document-edit-history-access-via-graphql-histories-field