An authenticated workspace member who is not a member of a private workspace can invoke the transclusion / sync‑block lookup API with known identifiers. Because the lookup resolves the source page before checking private‑space membership, the API can expose confidential sync‑block content and page metadata that normal page APIs would deny. This omission of access control constitutes a confidentiality breach (CWE‑639 and CWE‑862).

Docmost, the open‑source collaborative wiki platform. All releases older than 0.90.1 are impacted; the fix is present in 0.90.1 and newer.

The vendor CVSS score is 4.3, indicating low severity, and no EPSS value is available, so exploitation probability data is lacking. The vulnerability requires valid user credentials and a workspace membership, making it an insider‑or‑compromised‑account threat. Although not listed in the CISA KEV catalog, the potential to disclose private space content remains significant for confidentiality.