Auth bypass in Affine Monorepo
CVE-2026-59262
AFFiNE's histories GraphQL field fails to validate Doc.Read permission before exposing document edit history, allowing authenticated workspace members to retrieve restricted content timelines. Attackers can supply arbitrary document GUIDs to access full edit histories including user names, emails, and timestamps of private pages they lack access to.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.004 (33.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 34th percentile — 33.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Affine Monorepo — versions 0
Weakness classification (CWE)
References
- github.com/toeverything/AFFiNE/issues/15179 (issue-tracking)
- github.com/toeverything/AFFiNE (product)
- github.com/toeverything/AFFiNE/commit/1f0bcd01a37a522393fc1b288395e3a72a79ccad (patch)
- www.vulncheck.com/advisories/affine-unauthorized-document-edit-history-access-v… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-59262?
- CVE-2026-59262 is a medium-severity vulnerability in Affine Monorepo, classified under Missing Authorization. CVSS score: 6.5/10. Published 2026-07-08.
- How severe is CVE-2026-59262?
- Medium severity. CVSS v3 base score is 6.5 out of 10.