Executive brief
Docmost is an open-source platform used by teams to collaborate on documentation and wikis. A security flaw allows any logged-in user to overwrite files or attachments belonging to other pages within the same workspace. This could allow a malicious user to replace legitimate documentation with incorrect or harmful content, compromising the integrity of the organization's internal information.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in Docmost's file upload mechanism. Specifically, the `POST /api/files/upload` endpoint fails to properly validate if the authenticated user has the authority to modify a specific `attachmentId`. By supplying a target `attachmentId` belonging to a different page within the same workspace, a low-privileged attacker can overwrite existing files. This is a remote integrity issue that requires no victim interaction. The vulnerability is addressed in version 0.71.0.
Affected products
- Docmost Docmost >= 0.3.0, < 0.71.0
Timeline
- 2026-04-14: disclosed
- 2026-04-14: advisory
- 2026-04-14: patched: Fixed in version 0.71.0