The flaw is an improper authorization check that permits a low‑privileged authenticated user to overwrite an attachment uploaded to another page within the same workspace by supplying the victim’s attachmentId to the file upload endpoint. This allows the attacker to replace a legitimate file with a malicious or altered version, thereby compromising data integrity. The vulnerability is a remote integrity issue that requires no victim interaction and is identified as CWE‑639 (Access Control for Multi‑Level Security).

Docmost collaborative wiki and documentation software is affected. Versions beginning at 0.3.0 up to, but not including, 0.71.0 are vulnerable. All installations of these versions that allow authenticated users to upload attachments are at risk.

The CVSS score of 5.4 indicates a moderate level of risk. EPSS is not available, suggesting no known exploit activity at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. Because the exploit requires only authenticated access within a workspace, a legitimate low‑privileged user or attacker who has compromised account credentials can execute the attack remotely and immediately, making the risk realistic for environments with loose user permissions.