CVE-2026-59262

AFFiNE - Unauthorized Document Edit History Access via GraphQL histories Field

CVSS 7.1 HIGHEPSS 0.2%CWE-862

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 7.1EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

08 jul 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

AFFiNE's histories GraphQL field fails to validate Doc.Read permission before exposing document edit history, allowing authenticated workspace members to retrieve restricted content timelines. Attackers can supply arbitrary document GUIDs to access full edit histories including user names, emails, and timestamps of private pages they lack access to.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Produtos afetados

affine · monorepo

Referências

https://github.com/toeverything/AFFiNE https://github.com/toeverything/AFFiNE/commit/1f0bcd01a37a522393fc1b288395e3a72a79ccad https://github.com/toeverything/AFFiNE/issues/15179 https://www.vulncheck.com/advisories/affine-unauthorized-document-edit-history-access-via-graphql-histories-field