Skip to content
OpenAdvisories
Medium · 4.3 Public exploit CVE-2026-33146 EUVD-2026-22750

Docmost's Public Share Search Exposes Metadata of Restricted Children

Published Apr 14, 2026 · Updated Apr 15, 2026 · Assigned by GitHub_M

Vendor: docmost Product: docmost

Description

Docmost is open-source collaborative wiki and documentation software. An authorization bypass vulnerability in versions 0.70.0 through 0.70.2 exposes restricted child page titles and text snippets through the public search endpoint (`POST /api/search/share-search`) for publicly shared content. This flaw allows unauthenticated users to enumerate and retrieve content that should remain hidden from public share viewers, leading to a confidentiality breach. Version 0.70.3 contains a patch.

Affected products

VendorProductAffectedFixed
docmost docmost >= 0.70.0, < 0.70.3 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • 0xmrma/CVE-2026-33146 ★ 0 · Jun 26, 2026

    A public share looked clean in the page tree, but the search endpoint told a different story. In Docmost, restricted child pages hidden from public share viewers could still leak through public share…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References