CVE-2026-33146 Docmost's Public Share Search Exposes Metadata of Restricted Children

Medium 4.3 Published 14 Apr 2026 Updated 15 Apr 2026

Unauthenticated attackers can access restricted child page titles and snippets via the public search endpoint in Docmost, leading to information disclosure.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2026-33146?

CVE-2026-33146 is a medium-severity missing authorization vulnerability in docmost, published on 14 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Docmost is open-source collaborative wiki and documentation software. An authorization bypass vulnerability in versions 0.70.0 through 0.70.2 exposes restricted child page titles and text snippets through the public search endpoint (`POST /api/search/share-search`) for publicly shared content. This flaw allows unauthenticated users to enumerate and retrieve content that should remain hidden from public share viewers, leading to a confidentiality breach. Version 0.70.3 contains a patch.

Weakness: CWE-285

Which versions are affected by CVE-2026-33146?

It affects 1 product.

Products include Docmost Docmost.

How do I fix CVE-2026-33146?

No fix has been published for CVE-2026-33146 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-33146 being exploited?

There is no known exploitation of CVE-2026-33146 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as GHSA-qq4c-8rjr-w42c.