Description
Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspace invitation flow to invite an external email address with the OWNER role because the role ceiling does not prevent ADMIN users from granting privileges above their own. When the invitation is accepted, the new account receives OWNER-level permissions, allowing the ADMIN to create a backdoor OWNER account or promote a colluding external user to the workspace's highest privilege level. This issue is fixed in version 0.90.1.
Published: 2026-09-24
Score: 5.2 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Patch Now
AI Analysis

Impact

An authenticated workspace ADMIN can use the normal invitation flow to invite an external email address as an OWNER, because the application does not enforce the role ceiling and allows ADMIN users to grant higher privileges. The new account receives OWNER‑level permissions, creating a backdoor or allowing a colluding user to gain full control of the workspace.

Affected Systems

Docmost, an open‑source collaborative wiki and documentation platform, is affected in all releases prior to v0.90.1. The issue is limited to the workspace invitation functionality and the role assignment logic.

Risk and Exploitability

The CVSS score of 5.2 indicates moderate severity, while the EPSS score is not available and the vulnerability is not listed in the KEV catalog. The most likely attack vector is an authenticated ADMIN account abusing the invitation flow; no special privileges or network access are required beyond normal administrative usage.

Generated by OpenCVE AI on September 25, 2026 at 05:36 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Docmost to version 0.90.1 or later to remove the role assignment flaw.
  • Revoke any pending invitations that granted OWNER privileges to new or external users.
  • Audit current OWNER accounts and remove any that were added through the vulnerable invitation process.

Generated by OpenCVE AI on September 25, 2026 at 05:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 05 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 25 Sep 2026 10:00:00 +0000

Type Values Removed Values Added
First Time appeared Docmost
Docmost docmost
Vendors & Products Docmost
Docmost docmost

Thu, 24 Sep 2026 18:45:00 +0000

Type Values Removed Values Added
Description Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspace invitation flow to invite an external email address with the OWNER role because the role ceiling does not prevent ADMIN users from granting privileges above their own. When the invitation is accepted, the new account receives OWNER-level permissions, allowing the ADMIN to create a backdoor OWNER account or promote a colluding external user to the workspace's highest privilege level. This issue is fixed in version 0.90.1.
Title Docmost: Privilege Escalation - ADMIN Can Invite Users as OWNER
Weaknesses CWE-269
References
Metrics cvssV3_1

{'score': 5.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N'}

Subscriptions

Docmost Docmost
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-05T15:32:22.095Z

Reserved: 2026-06-08T18:41:27.724Z

Link: CVE-2026-52853

cve-icon Vulnrichment

Updated: 2026-10-05T14:47:01.132Z

cve-icon NVD

Status : Deferred

Published: 2026-09-24T19:17:14.100

Modified: 2026-10-05T16:17:14.100

Link: CVE-2026-52853

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T09:45:16Z

Weaknesses
  • CWE-269

    Improper Privilege Management