# CVE-2026-34213: Docmost improper authorization in file upload API

Source: https://junglewise.ai/threats/cve-2026-34213-docmost-improper-authorization-in-file-upload-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-14. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-34213 · Severity: medium · CVSS 5.4 · Published 2026-04-14

Docmost is an open-source platform used by teams to collaborate on documentation and wikis. A security flaw allows any logged-in user to overwrite files or attachments belonging to other pages within the same workspace. This could allow a malicious user to replace legitimate documentation with incorrect or harmful content, compromising the integrity of the organization's internal information.

Technologies: [Docmost](https://junglewise.ai/threats/technologies/docmost). Vendors: [Docmost](https://junglewise.ai/threats/vendors/docmost).

## Quick answers

**Is CVE-2026-34213 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34213 being exploited in the wild.

**How severe is CVE-2026-34213?** Medium severity, with a CVSS score of 5.4, published 14 April 2026.

**Which products and versions are affected?** Docmost >= 0.3.0, < 0.71.0.

**Is there a fix for CVE-2026-34213?** A patch was published on 2026-04-14: Fixed in version 0.71.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34213 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-34213?** Check whether you run Docmost at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in Docmost's file upload mechanism. Specifically, the `POST /api/files/upload` endpoint fails to properly validate if the authenticated user has the authority to modify a specific `attachmentId`. By supplying a target `attachmentId` belonging to a different page within the same workspace, a low-privileged attacker can overwrite existing files. This is a remote integrity issue that requires no victim interaction. The vulnerability is addressed in version 0.71.0.

## Affected products

- Docmost Docmost >= 0.3.0, < 0.71.0

## Timeline

- 2026-04-14: disclosed
- 2026-04-14: advisory
- 2026-04-14: patched: Fixed in version 0.71.0

## References

- [https://github.com/docmost/docmost/security/advisories/GHSA-89fp-2hch-j9gp](https://github.com/docmost/docmost/security/advisories/GHSA-89fp-2hch-j9gp)

## Related threats

- [Docmost ZIP bomb in page-import feature](https://junglewise.ai/threats/cve-2026-65827-docmost-is-open-source-collaborative-wiki-and-documentation)
- [Docmost privilege escalation in workspace invitation](https://junglewise.ai/threats/cve-2026-52853-docmost-is-open-source-collaborative-wiki-and-documentation)
- [Docmost access control bypass in transclusion API](https://junglewise.ai/threats/cve-2026-52850-docmost-is-open-source-collaborative-wiki-and-documentation)
- [Docmost authorization bypass in page export](https://junglewise.ai/threats/cve-2026-48073-docmost-is-open-source-collaborative-wiki-and-documentation)
- [Docmost path traversal in avatar and logo endpoint](https://junglewise.ai/threats/cve-2026-48072-docmost-is-open-source-collaborative-wiki-and-documentation)