From version 0.70.0 through 0.80.1, a user with low‑privilege edit rights on an exportable page can insert a forged attachment identifier that points to a restricted attachment within the same space. When the attacker exports the page with attachments included, the export routine reads the restricted file from storage and writes it into the returned ZIP file, bypassing the normal file download restriction. The result is that restricted content can be obtained by any authenticated user who can edit the page, leading to an unauthorized disclosure of sensitive data.

The vulnerability affects the community edition of Docmost as distributed on GitHub, specifically any release in the 0.70.0 through 0.80.1 range. Versions 0.80.1 and later incorporate the fix and are not affected.

The CVSS score of 4.3 indicates a low‑severity flaw. Because the EPSS score is not available, the short‑term exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. An attacker must possess an authenticated account that can edit an exportable page within a space; therefore, the attack vector is authenticated, not local. The impact is limited to confidentiality, as the flaw does not affect integrity or availability.