High
AFFiNE - Unauthorized Document Edit History Access via GraphQL histories Field
Type: advisorySources: OSV
AFFiNE's histories GraphQL field fails to validate Doc.Read permission before exposing document edit history, allowing authenticated workspace members to retrieve restricted content timelines. Attackers can supply arbitrary document GUIDs to access full edit histories including user names, emails, and timestamps of private pages they lack access to.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-59262
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 7 Nov 2026, 00:35 UTC · Revision 1
Source evidence
AFFiNE - Unauthorized Document Edit History Access via GraphQL histories Field
core-osv · Original sourcePublished 8 Jul 2026, 15:44 UTC
AFFiNE's histories GraphQL field fails to validate Doc.Read permission before exposing document edit history, allowing authenticated workspace members to retrieve restricted content timelines. Attackers can supply arbitrary document GUIDs to access full edit histories including user names, emails, and timestamps of private pages they lack access to.
osv:CVE-2026-59262
Complete source record
{
"id": "4215afaa7d6d04369b31f277e523a2a5a33743812aeab4a45cd8e1022059adaf",
"url": "https://osv.dev/vulnerability/CVE-2026-59262",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "AFFiNE - Unauthorized Document Edit History Access via GraphQL histories Field",
"summary": "AFFiNE's histories GraphQL field fails to validate Doc.Read permission before exposing document edit history, allowing authenticated workspace members to retrieve restricted content timelines. Attackers can supply arbitrary document GUIDs to access full edit histories including user names, emails, and timestamps of private pages they lack access to.",
"evidence": "osv:CVE-2026-59262",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-59262",
"aliases": [
"CVE-2026-59262"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/toeverything/affine",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "79460072bb7eda53834d88229c1de06c3697951c"
},
{
"fixed": "1f0bcd01a37a522393fc1b288395e3a72a79ccad"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "0.26.3"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"fixed": "1f0bcd01a37a522393fc1b288395e3a72a79ccad"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v0.26.3-beta.3",
"v0.26.3-beta.2",
"v0.26.3-beta.1",
"v0.26.3-beta.0",
"v0.26.2-beta.0",
"v0.26.2",
"v0.26.1-beta.1",
"v0.26.1",
"v0.26.1-beta.0",
"v0.26.0-beta.11",
"v0.26.0",
"v0.26.0-beta.10",
"v0.26.0-beta.9",
"v0.26.0-beta.8",
"v0.26.0-beta.7",
"v0.26.0-beta.6",
"v0.26.0-beta.5",
"v0.26.0-beta.4",
"v0.26.0-beta.3",
"v0.26.0-beta.2",
"v0.26.0-beta.1",
"v0.26.0-beta.0",
"v0.25.7-beta.0",
"v0.25.7",
"v0.25.6",
"v0.25.6-beta.0",
"v0.25.5",
"v0.25.5-beta.0",
"v0.25.4",
"v0.25.3-beta.0",
"v0.25.3",
"v0.25.1-beta.0",
"v0.25.1",
"v0.25.0",
"v0.25.0-beta.5",
"v0.25.0-beta.4",
"v0.25.0-beta.3",
"v0.25.0-beta.2",
"v0.25.0-beta.1",
"v0.25.0-beta.0",
"v0.24.2",
"v0.24.1",
"v0.24.1-beta.1",
"v0.24.0",
"v0.24.0-beta.8",
"v0.24.0-beta.7",
"v0.24.0-beta.6",
"v0.24.0-beta.5",
"v0.24.0-beta.4",
"v0.24.0-beta.3",
"v0.24.0-beta.2",
"v0.24.0-beta.1",
"v0.23.2-beta.2",
"v0.23.2",
"v0.23.2-beta.1",
"v0.23.1-beta.1",
"v0.23.1",
"0.23.0-beta.17",
"v0.23.0-beta.17",
"v0.23.0",
"v0.23.0-beta.16",
"0.23.0-beta.16",
"v0.23.0-beta.15",
"0.23.0-beta.15",
"v0.23.0-beta.14",
"0.23.0-beta.14",
"0.23.0-beta.13",
"v0.23.0-beta.13",
"0.23.0-beta.11",
"v0.23.0-beta.11",
"v0.23.0-beta.10",
"0.23.0-beta.10",
"v0.23.0-beta.9",
"v0.23.0-beta.8",
"0.23.0-beta.8",
"0.23.0-beta.7",
"v0.23.0-beta.7",
"v0.23.0-beta.5",
"v0.23.0-beta.4",
"v0.23.0-beta.3",
"0.23.0-beta.3",
"0.23.0-beta.2",
"v0.23.0-beta.2",
"v0.23.0-beta.1",
"v0.23.0-canary.2",
"v0.23.0-canary.1",
"v0.22.4-beta.1",
"v0.22.4",
"v0.22.3",
"v0.22.2-canary.1",
"v0.22.2-beta.1",
"v0.22.2",
"v0.22.1",
"v0.22.0-beta.5",
"v0.22.0",
"v0.22.0-beta.4",
"v0.22.0-canary.7",
"v0.22.0-beta.3",
"v0.22.0-canary.6",
"v0.22.0-beta.2",
"v0.22.0-canary.5",
"v0.22.0-beta.1",
"v0.22.0-canary.4",
"v0.22.0-canary.3",
"v0.22.0-canary.2",
"v0.22.0-canary.1",
"v0.21.3-canary.1",
"v0.21.3-beta.1",
"v0.21.3",
"v0.21.2-canary.1",
"v0.21.2-beta.1",
"v0.21.2",
"v0.21.1-beta.1",
"v0.21.1",
"v0.21.1-canary.1",
"v0.21.0-beta.4",
"v0.21.0",
"v0.21.0-beta.3",
"v0.21.0-beta.2",
"v0.21.0-beta.1",
"v0.21.0-canary.14",
"v0.21.0-canary.13",
"v0.21.0-canary.12",
"v0.21.0-canary.11",
"v0.21.0-canary.10",
"v0.21.0-canary.9",
"v0.21.0-canary.8",
"v0.21.0-canary.7",
"v0.21.0-canary.6",
"v0.21.0-canary.5",
"v0.21.0-canary.4",
"v0.21.0-canary.3",
"v0.21.0-canary.2",
"v0.21.0-canary.1",
"v0.20.5-canary.2",
"v0.20.3-canary.2",
"v0.20.3-beta.1",
"v0.20.3",
"v0.20.3-canary.1",
"v0.20.2-beta.1",
"v0.20.2",
"v0.20.1-beta.2",
"v0.20.1",
"v0.20.1-beta.1",
"v0.20.0-canary.16",
"v0.20.0-beta.8",
"v0.20.0",
"v0.20.0-beta.7",
"v0.20.0-canary.15",
"v0.20.0-beta.6",
"v0.20.0-canary.14",
"v0.20.0-beta.5",
"v0.20.0-canary.13",
"v0.20.0-beta.4",
"v0.20.0-canary.12",
"v0.20.0-beta.3",
"v0.20.0-canary.11",
"v0.20.0-beta.2",
"v0.20.0-canary.10",
"v0.20.0-beta.1",
"v0.20.0-canary.9",
"v0.20.0-canary.8",
"v0.20.0-canary.7",
"v0.20.0-canary.6",
"v0.20.0-canary.5",
"v0.20.0-canary.4",
"v0.20.0-canary.3",
"v0.19.4-beta.1",
"v0.19.4",
"v0.20.0-canary.2",
"v0.20.0-canary.1",
"v0.19.3-canary.1",
"v0.19.3-beta.1",
"v0.19.3",
"v0.19.2-beta.1",
"v0.19.2",
"v0.19.1",
"v0.19.0",
"v0.19.0-canary.12",
"v0.19.0-beta.2",
"v0.19.0-canary.11",
"v0.19.0-canary.10",
"v0.19.0-canary.9",
"v0.19.0-canary.8",
"v0.19.0-beta.1",
"v0.19.0-canary.7",
"v0.19.0-canary.6",
"v0.19.0-canary.5",
"v0.19.0-canary.4",
"v0.19.0-canary.3",
"v0.19.0-canary.2",
"v0.19.0-canary.1",
"0.19.0-canary.1",
"v0.18.1-beta.1",
"v0.18.1",
"v0.18.0-canary.9",
"v0.18.0-beta.4",
"v0.18.0",
"v0.18.0-canary.8",
"v0.18.0-beta.3",
"v0.18.0-canary.7",
"v0.18.0-canary.6",
"v0.18.0-canary.5",
"v0.18.0-beta.2",
"v0.18.0-beta.1",
"v0.18.0-canary.4",
"v0.18.0-canary.3",
"v0.18.0-canary.2",
"v0.18.0-canary.1",
"v0.17.3-canary.1",
"v0.17.3-beta.1",
"v0.17.3",
"v0.17.3-canary.2",
"v0.17.2-canary.2",
"v0.17.2-canary.1",
"v0.17.2-beta.1",
"v0.17.2",
"v0.17.1-canary.1",
"v0.17.1-beta.1",
"v0.17.1",
"v0.17.0",
"v0.17.0-canary.13",
"v0.17.0-beta.7",
"v0.17.0-canary.12",
"v0.17.0-beta.6",
"v0.17.0-beta.5",
"v0.17.0-canary.11",
"v0.17.0-canary.10",
"v0.17.0-beta.4",
"v0.17.0-canary.9",
"v0.17.0-beta.3",
"v0.17.0-beta.2",
"v0.17.0-canary.8",
"v0.17.0-beta.1",
"v0.16.4-beta.2",
"v0.16.3-beta.4",
"v0.17.0-canary.7",
"v0.17.0-canary.6",
"v0.16.4-beta.1",
"v0.17.0-canary.2",
"v0.16.3-beta.2",
"v0.16.3",
"v0.17.0-canary.5",
"v0.17.0-canary.4",
"v0.17.0-canary.3",
"v0.16.3-beta.1",
"v0.17.0-canary.1",
"v0.16.2-beta.1",
"v0.16.2",
"v0.16.1-beta.2",
"v0.16.1",
"v0.16.1-beta.1",
"v0.16.0-canary.13",
"v0.16.0-beta.6",
"v0.16.0",
"v0.16.0-beta.5",
"v0.16.0-beta.4",
"v0.16.0-beta.3",
"v0.16.0-canary.12",
"v0.16.0-canary.11",
"v0.16.0-beta.2",
"v0.16.0-beta.1",
"v0.15.7-beta.1",
"v0.15.7",
"v0.16.0-canary.10",
"v0.16.0-canary.9",
"v0.16.0-canary.7",
"v0.16.0-canary.6",
"v0.16.0-canary.5",
"v0.16.0-canary.4",
"v0.15.6-beta.1",
"v0.15.6",
"v0.16.0-canary.3",
"v0.15.5",
"0.15.5",
"v0.15.5-beta.1",
"v0.16.0-canary.2",
"v0.15.4",
"v0.16.0-canary.1",
"v0.15.3-beta.2",
"v0.15.3",
"v0.15.3-beta.1",
"v0.15.2-canary.2",
"v0.15.2-beta.1",
"v0.15.2",
"v0.15.2-canary.1",
"v0.15.1-beta.1",
"v0.15.1",
"v0.15.0-beta.17",
"v0.15.0",
"v0.15.0-beta.16",
"v0.15.0-canary.23",
"v0.15.0-beta.15",
"v0.15.0-canary.22",
"v0.15.0-canary.21",
"v0.15.0-beta.14",
"v0.14.9",
"v0.15.0-canary.20",
"v0.15.0-beta.13",
"v0.15.0-canary.19",
"v0.15.0-beta.12",
"v0.14.8",
"v0.15.0-canary.18",
"v0.15.0-canary.17",
"v0.15.0-canary.16",
"v0.15.0-beta.11",
"v0.15.0-canary.15",
"v0.15.0-canary.14",
"v0.15.0-canary.13",
"v0.15.0-beta.10",
"v0.15.0-beta.9",
"v0.15.0-canary.12",
"v0.15.0-canary.11",
"v0.15.0-beta.8",
"v0.14.7",
"v0.15.0-canary.10",
"v0.15.0-canary.9",
"v0.15.0-beta.7",
"v0.14.6",
"v0.15.0-beta.6",
"v0.14.5",
"v0.15.0-canary.8",
"v0.15.0-canary.7",
"v0.15.0-canary.6",
"v0.15.0-beta.5",
"v0.14.4",
"v0.15.0-canary.5",
"v0.15.0-beta.4",
"v0.14.3",
"v0.15.0-canary.4",
"v0.15.0-beta.3",
"v0.14.2",
"v0.15.0-beta.2",
"v0.15.0-canary.3",
"v0.15.0-beta.1",
"v0.15.0-canary.2",
"v0.15.0-canary.1",
"v0.15.0-canary.0",
"v0.15.0-beta.0",
"v0.14.1",
"v0.14.0-canary.14",
"v0.14.0-canary.13",
"v0.14.0-canary.12",
"v0.14.0-canary.11",
"v0.14.0-canary.10",
"v0.14.0-canary.9",
"v0.14.0-canary.8",
"v0.14.0-canary.7",
"v0.14.0-canary.6",
"v0.14.0-canary.5",
"v0.14.0-canary.4",
"v0.14.0-canary.3",
"v0.14.0-beta.0",
"v0.14.0-canary.2",
"v0.14.0-canary.1",
"v0.14.0-canary.0",
"v0.13.0-canary.7",
"v0.13.0-canary.6",
"v0.13.0-beta.0",
"v0.13.0-canary.5",
"v0.13.0-canary.4",
"v0.13.0-canary.3",
"v0.13.0-canary.2",
"v0.13.0-canary.1",
"v0.13.0-canary.0",
"v0.12.0-canary.1",
"v0.12.0-canary.0",
"v0.11.3-canary.8",
"v0.11.3-canary.7",
"v0.11.3-canary.6",
"v0.11.3-canary.5",
"v0.11.3-canary.4",
"v0.11.3-canary.3",
"v0.11.3-canary.2",
"v0.11.3-canary.1",
"v0.11.3-canary.0",
"0.11.0-nightly-202312280901-e11e827",
"v0.11.1-canary.1",
"v0.11.0-canary.10",
"v0.11.0-canary.9",
"v0.11.0-canary.8",
"0.10.3-canary.2",
"v0.10.3-canary.1",
"v0.10.3-canary.0",
"v0.10.0-canary.16",
"0.10.0-canary.14",
"v0.10.0-canary.10",
"v0.10.0-canary.9",
"v0.10.0-canary.8",
"v0.10.0-canary.6",
"v0.10.0-canary.5",
"v0.10.0-canary.4",
"v0.10.0-canary.3",
"v0.10.0-canary.2",
"v0.10.0-canary.1",
"v0.9.0-beta.2",
"0.9.0-beta.1",
"0.9.0-beta.0",
"v0.9.0-canary.13",
"v0.9.0-canary.12",
"v0.9.0-canary.11",
"v0.9.0-canary.10",
"v0.9.0-canary.9",
"v0.9.0-canary.8",
"v0.9.0-canary.7",
"v0.9.0-canary.6",
"v0.9.0-canary.5",
"v0.9.0-canary.3",
"v0.9.0-canary.2",
"v0.9.0-canary.1",
"v0.9.0-canary.0",
"v0.8.0-canary.34",
"v0.8.0-canary.33",
"v0.8.0-canary.32",
"v0.8.0-canary.31",
"v0.8.0-canary.30",
"v0.8.0-canary.29",
"v0.8.0-canary.28",
"v0.8.0-canary.27",
"v0.8.0-canary.26",
"v0.8.0-canary.25",
"v0.8.0-canary.24",
"v0.8.0-canary.23",
"v0.8.0-canary.22",
"v0.8.0-canary.21",
"v0.8.0-canary.20",
"v0.8.0-canary.19",
"v0.8.0-canary.18",
"v0.8.0-canary.17",
"v0.8.0-canary.16",
"v0.8.0-canary.15",
"v0.8.0-canary.14",
"v0.8.0-canary.13",
"v0.8.0-canary.12",
"v0.8.0-canary.11",
"v0.8.0-canary.10",
"v0.8.0-canary.9",
"v0.8.0-canary.8",
"v0.8.0-canary.7",
"v0.8.0-canary.6",
"v0.8.0-canary.5",
"v0.8.0-canary.4",
"v0.8.0-canary.3",
"v0.8.0-canary.2",
"v0.8.0-canary.1",
"v0.8.0-canary.0",
"v0.7.0-canary.59",
"v0.7.0-canary.58",
"v0.7.0-canary.57",
"v0.7.0-canary.56",
"v0.7.0-canary.55",
"v0.7.0-canary.54",
"v0.7.0-canary.53",
"v0.7.0-canary.52",
"v0.7.0-canary.51",
"v0.7.0-canary.50",
"v0.7.0-canary.49",
"v0.7.0-canary.48",
"v0.7.0-canary.47",
"v0.7.0-canary.46",
"v0.7.0-canary.45",
"v0.7.0-canary.44",
"v0.7.0-canary.43",
"v0.7.0-canary.42",
"v0.7.0-canary.41",
"v0.7.0-canary.40",
"v0.7.0-canary.39",
"v0.7.0-canary.38",
"v0.7.0-canary.37",
"v0.7.0-canary.36",
"v0.7.0-canary.35",
"v0.7.0-canary.34",
"v0.7.0-canary.33",
"v0.7.0-canary.32",
"v0.7.0-canary.31",
"v0.7.0-canary.30",
"v0.7.0-canary.29",
"v0.7.0-canary.28",
"v0.7.0-canary.27",
"v0.7.0-canary.26",
"v0.7.0-canary.25",
"v0.7.0-canary.20",
"v0.7.0-canary.24",
"v0.7.0-canary.23",
"v0.7.0-canary.22",
"v0.7.0-canary.19",
"v0.7.0-canary.18",
"v0.7.0-canary.17",
"v0.7.0-canary.16",
"v0.7.0-canary.15",
"v0.7.0-canary.14",
"v0.7.0-canary.13",
"v0.7.0-canary.12",
"v0.7.0-canary.11",
"v0.7.0-canary.10",
"v0.7.0-canary.9",
"v0.7.0-canary.8",
"v0.7.0-canary.7",
"v0.7.0-canary.6",
"v0.7.0-canary.5",
"v0.7.0-canary.4",
"v0.7.0-canary.3",
"v0.7.0-canary.2",
"v0.7.0-canary.1",
"v0.7.0-canary.0",
"v0.6.0-canary.8",
"v0.6.0-canary.7",
"v0.6.0-canary.6",
"0.6.0-canary.5",
"v0.6.0-canary.5",
"v0.6.0-canary.4",
"v0.6.0-canary.3",
"v0.6.0-canary.2",
"v0.6.0-canary.1",
"v0.6.0-canary.0",
"v0.5.4-canary.31",
"v0.5.4-canary.30",
"v0.5.4-canary.29",
"v0.5.4-canary.28",
"v0.5.4-canary.27",
"v0.5.4-canary.26",
"v0.5.4-canary.25",
"v0.5.4-canary.24",
"v0.5.4-canary.23",
"v0.5.4-canary.22",
"v0.5.4-canary.21",
"v0.5.4-canary.20",
"v0.5.4-canary.19",
"v0.5.4-canary.18",
"v0.5.4-canary.17",
"v0.5.4-canary.16",
"v0.5.4-canary.15",
"v0.5.4-canary.14",
"v0.5.4-canary.13",
"v0.5.4-canary.12",
"v0.5.4-canary.11",
"v0.5.4-canary.10",
"v0.5.4-canary.9",
"v0.5.4-canary.8",
"v0.5.4-beta.0",
"v0.5.4-canary.7",
"v0.5.4-canary.6",
"v0.5.4-canary.5",
"v0.5.4-canary.4",
"v0.5.4-canary.3",
"v0.5.4-canary.2",
"v0.5.4-canary.1",
"v0.5.4-canary.0",
"v0.5.3",
"v0.5.2",
"v0.5.1",
"0.5.1",
"v0.5.0-canary.0",
"0.5.0-canary.0",
"0.5.0",
"v0.0.2-2023.04.08-alpha-kreta-ayer",
"v0.0.1-alpha-Abbey-Wood",
"v0.0.1-alpha.0.4.1",
"v0.0.1-alpha.0.3.4"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59262.json"
}
}
],
"modified": "2026-10-28T02:30:48.297235301Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59262.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-59262",
"https://www.vulncheck.com/advisories/affine-unauthorized-document-edit-history-access-via-graphql-histories-field",
"https://github.com/toeverything/AFFiNE/issues/15179",
"https://github.com/toeverything/AFFiNE/commit/1f0bcd01a37a522393fc1b288395e3a72a79ccad",
"https://github.com/toeverything/AFFiNE"
],
"provider_metadata": {
"cwe_ids": [
"CWE-862"
],
"cna_assigner": "VulnCheck",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"last_affected": "1f0bcd0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59262.json"
}
},
"related_cves": [
{
"value": "CVE-2026-59262",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 516662,
"published_at": "2026-07-08T15:44:07.878+00:00"
}