Executive brief
AFFiNE, an open-source knowledge base and workspace tool, contains a security flaw where document edit histories are not properly protected. This allows any logged-in member of a workspace to view the private edit history of documents they are not authorized to see. An attacker could use this to harvest sensitive information such as user names, email addresses, and activity timelines from private pages, potentially leading to data leaks and privacy violations.
Technical details
A missing authorization check (CWE-862) exists in the GraphQL 'histories' field resolver within AFFiNE. The application fails to verify 'Doc.Read' permissions before returning document snapshots. An authenticated attacker with workspace access can provide arbitrary document GUIDs to the GraphQL endpoint to retrieve full edit histories. This exposed data includes editor names, email addresses, and timestamps for private documents the attacker is otherwise restricted from viewing. The issue has been addressed in version 0.26.3 by enforcing permission checks in the histories resolver.
Affected products
- AFFiNE AFFiNE monorepo < 0.26.3
Timeline
- 2026-07-08: disclosed
- 2026-07-08: advisory
- 2026-07-08: patched: Fixed in version 0.26.3 and commit 1f0bcd0