CVE-2026-33146

OVERVIEW Docmost, an open-source collaborative wiki and documentation platform, contains an authorization bypass vulnerability in versions 0.70.0 through 0.70.2 that exposes restricted child page titles and text snippets through the public search endpoint. The flaw allows unauthenticated attackers to enumerate and retrieve content that should remain hidden from public share viewers, resulting in unauthorized information disclosure. A patch is available in version 0.70.3. SEVERITY The vulnerability carries a CVSS v3.1 score of 4.3 (MEDIUM) with a network-based attack vector requiring no privileges or special configuration, though user interaction is needed. The attack complexity is low, and impact is limited to confidentiality with no integrity or availability consequences. The FAUCET Risk Score of 30.0/100 and low EPSS score of 0.0004 indicate this poses a moderate threat with minimal current exploitation probability. EXPLOITATION STATUS This vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog and shows no active exploitation in the wild. The vulnerability remains on the inactive Hot List, suggesting limited community attention. Organizations running affected versions should prioritize patching to version 0.70.3 to remediate the authorization bypass, though the low EPSS score suggests immediate exploitation risk is currently minimal.