CVE-2026-50885: Sismics Docs v1.11 Unauthorized Access via Improper Share Endpoint Controls

Technical summary

CVE-2026-50885 is an improper access control vulnerability (CWE-284) in Sismics Docs v1.11 affecting the share-based read endpoints. The vulnerability allows unauthenticated attackers to bypass authorization checks and access restricted endpoints via a crafted HTTP request. The attack surface is network-accessible, requires no privileges or user interaction, and results in confidentiality impact through unauthorized information disclosure. The CVSS v3.1 score of 7.5 (HIGH) reflects the combination of remote exploitability, lack of authentication barriers, and high confidentiality impact.

Business impact

Unauthorized access to shared documents and metadata can lead to exposure of confidential business information, intellectual property, client data, or other sensitive materials stored within Sismics Docs. If your organization uses Teedy for document management with restricted sharing controls, this vulnerability could undermine those protections entirely. The lack of a required fix in KEV as of publication suggests this may not yet be weaponized at scale, but remediation should be prioritized nonetheless given the ease of exploitation.

Affected systems

Sismics Docs (Teedy) version 1.11 is confirmed affected. Users of earlier or later versions should consult the vendor's advisory to determine their exposure. The vulnerability does not require any specific configuration or feature enablement—it affects the core share-based read functionality. Any instance with network exposure is at risk.

Exploitability

This vulnerability has a low barrier to exploitation. No authentication is required, no special complexity is involved in crafting the malicious request, and the attack is triggered over standard network protocols. An attacker needs only network-level access to the affected endpoint. The lack of exploitation barriers and the simplicity of the attack vector mean that weaponized proof-of-concept code, once available, would be straightforward to deploy at scale.

Remediation

Upgrade Sismics Docs to a patched version released by the vendor after the vulnerability publication date (June 15, 2026). Consult the official Sismics or Teedy project repository for the specific patch version addressing CVE-2026-50885. If immediate patching is not possible, restrict network access to Docs instances using firewall rules or require a VPN gateway to limit exposure until a patch can be applied.

Patch guidance

Check the official Sismics Docs (Teedy) GitHub repository or project website for releases published after June 15, 2026 that explicitly reference CVE-2026-50885. Apply the recommended patch version to all affected instances. Test the patch in a non-production environment first to ensure compatibility with your document workflows and any custom integrations. After patching, verify that the share-based endpoints enforce proper access controls by testing with and without valid credentials.

Detection guidance

Monitor for HTTP requests to the share-based read endpoints (typically paths containing '/share/' or similar) that originate from sources without valid session tokens or API authentication. Log and alert on any 200 OK responses to these endpoints when authentication is expected. Review access logs for patterns of repeated requests to shared document endpoints by the same source or unusual geographic origins. Consider implementing intrusion detection signatures that identify crafted requests bypassing the normal share-access workflow.

Why prioritize this

Although not yet listed in CISA's KEV catalog, the HIGH CVSS score (7.5) combined with unauthenticated remote exploitability and high confidentiality impact makes this a priority-one remediation. Organizations using Sismics Docs for sensitive document storage should treat this as critical. The ease of exploitation and lack of user interaction required mean that delay increases the window of risk, especially if public exploit code emerges.

Risk score, explained

The CVSS v3.1 score of 7.5 reflects: (1) Network-accessible attack vector with no authentication required (AV:N, PR:N); (2) Low attack complexity—standard HTTP requests suffice (AC:L); (3) No user interaction needed (UI:N); (4) Unauthorized confidentiality impact through information disclosure (C:H); (5) No integrity or availability impact (I:N, A:N). The score appropriately captures a high-risk but non-critical vulnerability.

Frequently asked questions