CVE-2026-59262: AFFiNE Document History Authorization Bypass

Technical summary

The vulnerability exists in AFFiNE's GraphQL endpoint handling of the 'histories' field. The API fails to enforce Doc.Read permission checks before returning document edit history data. An authenticated workspace member can supply arbitrary document GUIDs and retrieve complete revision timelines, exposing metadata such as usernames, email addresses, and modification timestamps for documents outside their assigned permissions. The root cause is missing authorization validation at the GraphQL resolver level before sensitive history data is serialized and returned to the client.

Business impact

Organizations using AFFiNE for sensitive collaborative work face uncontrolled exposure of document access patterns and contributor identity. Competitors or malicious insiders could infer what documents exist, who is working on them, and activity timing—useful for social engineering, competitive intelligence, or identifying high-value targets within the workspace. Compliance frameworks (HIPAA, GDPR, SOC 2) may be violated if private document metadata is exposed to unauthorized users. Trust in document access controls is undermined for any workspace containing sensitive information.

Affected systems

AFFiNE instances with GraphQL API enabled are affected. Any workspace where authenticated users can access the 'histories' field for documents they do not have explicit Doc.Read permission on is vulnerable. No specific product versions are identified in the advisory; verify with AFFiNE's official security advisory for affected release lines and patched versions.

Exploitability

Exploitability is straightforward. An attacker requires only valid workspace authentication—a legitimate user account with any permission level in the target workspace. No special network access, user interaction, or advanced techniques are needed. The attacker can automate requests to enumerate document GUIDs and harvest edit histories. The low complexity and lack of user interaction requirements make this a practical exploit for insider threats or compromised low-privilege accounts.

Remediation

AFFiNE must implement authorization checks in the 'histories' GraphQL resolver to verify that the requesting user holds Doc.Read permission on the target document before returning any history data. This should follow a deny-by-default principle: only return history if the user has explicit access to the document. Apply the patch released by AFFiNE as soon as testing confirms compatibility with your deployment.

Patch guidance

Monitor the AFFiNE project repository and security advisory channels for version updates addressing this authorization bypass. When a patch is released, verify the version number and changelog confirm the fix to the 'histories' GraphQL field authorization logic. Test the patch in a non-production environment to ensure it does not break existing document history features for authorized users. Coordinate deployment to minimize workspace downtime if required. Refer to the official AFFiNE security advisory for specific patched version numbers and upgrade procedures.

Detection guidance

Examine GraphQL query logs for repeated requests to the 'histories' field with varying document GUIDs, particularly from accounts with minimal permissions. Monitor for queries from users requesting history on documents they have not accessed through normal UI workflows. Implement rate limiting on the 'histories' endpoint to slow enumeration attacks. Review workspace access logs to identify which users have queried document histories and cross-reference against their explicit Doc.Read permissions. Consider disabling the 'histories' GraphQL field entirely until a patch is deployed if sensitive documents are at high risk.

Why prioritize this

Although marked CVSS 6.5 (Medium), this vulnerability merits prompt attention because: (1) it requires only basic authentication, making it accessible to any workspace member; (2) it exposes PII (names, emails) and metadata about private documents; (3) it directly violates the confidentiality model users expect from collaborative tools; (4) it is likely trivial to exploit at scale; and (5) it may trigger regulatory notifications depending on document sensitivity. Organizations with highly confidential or regulated content should prioritize patching sooner rather than later.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects the following factors: Network-based attack vector (AV:N), low attack complexity (AC:L), and requirement for authentication (PR:L) lower the score compared to unauthenticated vulnerabilities. The high confidentiality impact (C:H) from unrestricted history access elevates the score. No integrity or availability impact is present (I:N/A:N) because the attacker cannot modify documents or take the service offline. The Medium severity is appropriate for a permission bypass affecting information disclosure, though business context and data sensitivity may warrant higher internal priority.

Frequently asked questions