What’s Vulnerable › Vulnerabilities

CVE-2026-59262: AFFiNE - Unauthorized Document Edit History Access via GraphQL histories Field

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-08 · updated 2026-10-25
• Weakness: CWE-862

Description

AFFiNE's histories GraphQL field fails to validate Doc.Read permission before exposing document edit history, allowing authenticated workspace members to retrieve restricted content timelines. Attackers can supply arbitrary document GUIDs to access full edit histories including user names, emails, and timestamps of private pages they lack access to.

Affected products

• affine monorepo: before 0.26.3; through 1f0bcd0 — fixed in 0.26.3

How to fix

Upgrade to a fixed version: affine monorepo 0.26.3. Check the vendor advisory for mitigations.

References

• https://github.com/toeverything/AFFiNE
• https://github.com/toeverything/AFFiNE/commit/1f0bcd01a37a522393fc1b288395e3a72a79ccad
• https://github.com/toeverything/AFFiNE/issues/15179
• https://www.vulncheck.com/advisories/affine-unauthorized-document-edit-history-access-via-graphql-histories-field
• https://github.com/toeverything/AFFiNE/issues/15179

Get alerted when CVE-2026-59262 or the next vulnerability affects your stack