Vulnerability · Published May 3, 2026 · Assigned by VulDB
CVE-2026-7702toeverything AFFiNE Public Markdown Preview Endpoint :docId allowDocPreview authorization
Medium 5.3
In plain English
A medium-severity authorization bypass via user-controlled key in AFFiNE from toeverything. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Official description
A vulnerability was detected in toeverything AFFiNE up to 0.26.3. This issue affects the function allowDocPreview of the file /workspace/:workspaceId/:docId of the component Public Markdown Preview Endpoint. The manipulation results in authorization bypass. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| toeverything | AFFiNE | 0.26.00.26.10.26.20.26.3 |
Weakness: CWE-639, CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
References
- VDB-360871 | toeverything AFFiNE Public Markdown Preview Endpoint :docId allowDocPreview authorization vdb-entry, technical-description
- VDB-360871 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- Submit #804455 | AFFiNE AFFiNE (https://github.com/toeverything/AFFiNE) 0.26.3 Authorization Bypass third-party-advisory
- https://github.com/ngocnn97/security-advisories/blob/main/AFFiNE_BAC_PoC.mp4 exploit