CVE-2026-52853 json
Docmost: Privilege Escalation - ADMIN Can Invite Users as OWNER
published 2026-09-24 45 d ago modified 2026-10-05 34 d ago also EUVD-2026-86391
- cvss
- 5.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 10%
- public exploits
- 0
- none known
Summary
Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspace invitation flow to invite an external email address with the OWNER role because the role ceiling does not prevent ADMIN users from granting privileges above their own. When the invitation is accepted, the new account receives OWNER-level permissions, allowing the ADMIN to create a backdoor OWNER account or promote a colluding external user to the workspace's highest privilege level. This issue is fixed in version 0.90.1.
Patch / fix
- github.com/docmost/docmost@33895b0 commit
- github.com/docmost/docmost#2250 pull request
- github.com/docmost/docmost/releases/tag/v0.90.1 release
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 34 d ago
Exploit prediction
0.21% chance of exploitation in the next 30 days, higher than 10% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N |
Affected products
- docmost docmost
Classification
- Weakness
-
- CWE-269 Improper Privilege Management
References
Sources
- CVE List CVE-2026-52853
- NVD CVE-2026-52853
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.