Executive brief
Docs is a collaborative document editor that allows users to edit documents together in real-time. When an administrator revokes a user's access to a parent document, the system fails to disconnect that user's active collaboration sessions on child documents, allowing them to continue reading and editing the document's contents indefinitely despite having no permission.
Technical details
The vulnerability is an access control bypass in the document access revocation mechanism. When DocumentAccess records are created, updated, or deleted in src/backend/core/api/viewsets.py, the code calls CollaborationService().reset_connections() using only the parent document's ID. However, the y-provider collaboration server's connection handler only closes websocket connections matching that exact room ID, missing all descendant documents. An attacker who had access to a parent document and opened a websocket session to a child document can retain full read/write access after being revoked at the parent level, since the websocket connection is never terminated. The fix walks the document tree via get_descendants() and resets connections for all descendant document IDs, not just the parent.
Affected products
- Docs Docs before 5.4.1
Timeline
- 2026-07-06: disclosed: Reported via email
- 2026-08-25: advisory: Followed up via email
- 2026-08-25: patched: Fixed via commit d35b81a6ed526dc284c8d0f68b762f2e81ffab13