# CVE-2026-48073: Docmost authorization bypass in page export

Source: https://junglewise.ai/threats/cve-2026-48073-docmost-is-open-source-collaborative-wiki-and-documentation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-48073 · Severity: medium · CVSS 4.3 · Published 2026-09-24

Docmost is an open-source wiki and documentation platform used for collaborative content creation. A low-privileged user with edit access can exploit the page export feature to retrieve confidential attachments from restricted pages by embedding forged attachment references, circumventing normal access controls and exposing sensitive files in exported archives.

Technologies: [Docmost](https://junglewise.ai/threats/technologies/docmost). Vendors: [Docmost](https://junglewise.ai/threats/vendors/docmost).

## Quick answers

**Is CVE-2026-48073 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48073 being exploited in the wild.

**How severe is CVE-2026-48073?** Medium severity, with a CVSS score of 4.3, published 24 September 2026.

**Which products and versions are affected?** Docmost 0.70.0 to 0.80.0.

**Is there a fix for CVE-2026-48073?** A patch was published on 2026-04-28: Fixed in version 0.80.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48073 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48073?** Check whether you run Docmost at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A low-privileged authenticated user with edit permissions on an exportable page can embed a forged attachmentId pointing to a restricted page's attachment within the same workspace. When the attacker exports their page with includeAttachments=true, the export flow fails to validate attachment access permissions and includes the restricted file in the returned ZIP archive, bypassing the direct download access controls. The vulnerability was fixed in version 0.80.1 by adding proper authorization checks during the export process.

## Affected products

- Docmost Docmost 0.70.0 to 0.80.0

## Timeline

- 2026-09-24: disclosed
- 2026-04-28: patched: Fixed in version 0.80.1

## References

- [https://github.com/docmost/docmost/commit/a573acedd0317f3472cb0f8b95f6aa15315312e5](https://github.com/docmost/docmost/commit/a573acedd0317f3472cb0f8b95f6aa15315312e5)
- [https://github.com/docmost/docmost/releases/tag/v0.80.1](https://github.com/docmost/docmost/releases/tag/v0.80.1)

## Related threats

- [Docmost ZIP bomb in page-import feature](https://junglewise.ai/threats/cve-2026-65827-docmost-is-open-source-collaborative-wiki-and-documentation)
- [Docmost privilege escalation in workspace invitation](https://junglewise.ai/threats/cve-2026-52853-docmost-is-open-source-collaborative-wiki-and-documentation)
- [Docmost access control bypass in transclusion API](https://junglewise.ai/threats/cve-2026-52850-docmost-is-open-source-collaborative-wiki-and-documentation)
- [Docmost path traversal in avatar and logo endpoint](https://junglewise.ai/threats/cve-2026-48072-docmost-is-open-source-collaborative-wiki-and-documentation)
- [Docmost arbitrary file deletion in avatar cleanup on local storage](https://junglewise.ai/threats/cve-2026-48070-docmost-is-open-source-collaborative-wiki-and-documentation)