CVE-2026-52853
Docmost: Privilege Escalation - ADMIN Can Invite Users as OWNER
CVSS Score
5.2
EPSS Score
0.0%
EPSS Percentile
0th
Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspace invitation flow to invite an external email address with the OWNER role because the role ceiling does not prevent ADMIN users from granting privileges above their own. When the invitation is accepted, the new account receives OWNER-level permissions, allowing the ADMIN to create a backdoor OWNER account or promote a colluding external user to the workspace's highest privilege level. This issue is fixed in version 0.90.1.
| CWE | CWE-269 |
| Vendor | docmost |
| Product | docmost |
| Published | Sep 24, 2026 |
Stay Ahead of the Next One
Get instant alerts for docmost docmost
Be the first to know when new medium vulnerabilities affecting docmost docmost are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None
Affected Versions
docmost / docmost
< 0.90.1
References
github.com: https://github.com/docmost/docmost/security/advisories/GHSA-84fx-mvqx-p5gx github.com: https://github.com/docmost/docmost/pull/2250 github.com: https://github.com/docmost/docmost/commit/33895b060790358869f54ae451c3848480b39503 github.com: https://github.com/docmost/docmost/releases/tag/v0.90.1