The vulnerability derives from an authorization oversight in the histories GraphQL field, which fails to verify Doc.Read permissions before returning edit history data. As a result, authenticated workspace members can request any document GUID and gain access to full edit histories, exposing usernames, email addresses, and timestamps associated with private pages, thereby compromising confidentiality.

The issue impacts the AFFiNE monorepo product developed by affine. No specific version numbers are provided, but any deployment that exposes the unchecked GraphQL histories endpoint is susceptible.

The CVSS base score of 7.1 signals a high potential impact if exploited. An EPSS score of < 1% indicates that exploitation is unlikely but not impossible, and the vulnerability is not catalogued in the CISA KEV list. Exploitation requires an authenticated workspace member; by supplying arbitrary document GUIDs to the GraphQL histories field, the absent Doc.Read permission check allows them to retrieve detailed edit histories. Because the check occurs at the application layer, any environment that exposes the GraphQL endpoint to authenticated users faces this risk.