A vulnerability was found in the toeverything AFFiNE application up to version 0.26.3. The flaw resides in the allowDocPreview function of the Public Markdown Preview endpoint located at /workspace/:workspaceId/:docId. By manipulating the docId parameter, an attacker can bypass normal authorization checks and view the content of documents for which they have no permission. The effect is a loss of confidentiality and potential integrity violations, as sensitive markdown files may be accessed without authentication. This flaw is classified as an authorization bypass (CWE‑285) and also involves improper privilege validation (CWE‑639).

The affected vendor is toeverything, product AFFiNE, specifically all versions up to and including 0.26.3. The issue affects the Public Markdown Preview component of the application. Users running these versions should review the version number and consider upgrades.

The CVSS score of 6.9 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The vulnerability can be exploited remotely by sending crafted requests to the preview endpoint. Since the exploit is publicly available and the vendor has not responded, the risk of attack is present, especially for deployments that expose the preview endpoint to untrusted networks.