Vulnerability · Published Jul 8, 2026 · Assigned by VulnCheck
CVE-2026-59262AFFiNE - Unauthorized Document Edit History Access via GraphQL histories Field
Medium 6.5
In plain English
A medium-severity missing authorization in monorepo from affine. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.4%top 64.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
AFFiNE's histories GraphQL field fails to validate Doc.Read permission before exposing document edit history, allowing authenticated workspace members to retrieve restricted content timelines. Attackers can supply arbitrary document GUIDs to access full edit histories including user names, emails, and timestamps of private pages they lack access to.
Affected products (as reported)
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- GitHub Issue issue-tracking
- Product product
- Patch Commit patch
- https://www.vulncheck.com/advisories/affine-unauthorized-document-edit-history-access-via-graphql-histories-field third-party-advisory