CVE-2026-59262

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-59262

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59262.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-59262

Published

2026-07-08T15:44:07.878Z

Modified

2026-07-15T01:49:15.071805260Z

Severity

7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

AFFiNE - Unauthorized Document Edit History Access via GraphQL histories Field

Details

AFFiNE's histories GraphQL field fails to validate Doc.Read permission before exposing document edit history, allowing authenticated workspace members to retrieve restricted content timelines. Attackers can supply arbitrary document GUIDs to access full edit histories including user names, emails, and timestamps of private pages they lack access to.

Database specific

{
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59262.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "last_affected": "1f0bcd0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "VulnCheck"
}

References

Affected packages

Git / github.com/toeverything/affine

Affected ranges

Type

GIT

Repo

https://github.com/toeverything/affine

Events

Introduced

Fixed

1f0bcd01a37a522393fc1b288395e3a72a79ccad

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.26.3"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*

0.10.0-canary.14

0.10.3-canary.2

0.11.0-nightly-202312280901-e11e827

0.15.5

0.19.0-canary.1

0.23.0-beta.10

0.23.0-beta.11

0.23.0-beta.13

0.23.0-beta.14

0.23.0-beta.15

0.23.0-beta.16

0.23.0-beta.17

0.23.0-beta.2

0.23.0-beta.3

0.23.0-beta.7

0.23.0-beta.8

0.5.0

0.5.0-canary.0

0.5.1

0.6.0-canary.5

0.9.0-beta.0

0.9.0-beta.1

v0.*

v0.0.1-alpha-Abbey-Wood

v0.0.1-alpha.0.3.4

v0.0.1-alpha.0.4.1

v0.0.2-2023.04.08-alpha-kreta-ayer

v0.10.0-canary.1

v0.10.0-canary.10

v0.10.0-canary.16

v0.10.0-canary.2

v0.10.0-canary.3

v0.10.0-canary.4

v0.10.0-canary.5

v0.10.0-canary.6

v0.10.0-canary.8

v0.10.0-canary.9

v0.10.3-canary.0

v0.10.3-canary.1

v0.11.0-canary.10

v0.11.0-canary.8

v0.11.0-canary.9

v0.11.1-canary.1

v0.11.3-canary.0

v0.11.3-canary.1

v0.11.3-canary.2

v0.11.3-canary.3

v0.11.3-canary.4

v0.11.3-canary.5

v0.11.3-canary.6

v0.11.3-canary.7

v0.11.3-canary.8

v0.12.0-canary.0

v0.12.0-canary.1

v0.13.0-beta.0

v0.13.0-canary.0

v0.13.0-canary.1

v0.13.0-canary.2

v0.13.0-canary.3

v0.13.0-canary.4

v0.13.0-canary.5

v0.13.0-canary.6

v0.13.0-canary.7

v0.14.0-beta.0

v0.14.0-canary.0

v0.14.0-canary.1

v0.14.0-canary.10

v0.14.0-canary.11

v0.14.0-canary.12

v0.14.0-canary.13

v0.14.0-canary.14

v0.14.0-canary.2

v0.14.0-canary.3

v0.14.0-canary.4

v0.14.0-canary.5

v0.14.0-canary.6

v0.14.0-canary.7

v0.14.0-canary.8

v0.14.0-canary.9

v0.14.1

v0.14.2

v0.14.3

v0.14.4

v0.14.5

v0.14.6

v0.14.7

v0.14.8

v0.14.9

v0.15.0

v0.15.0-beta.0

v0.15.0-beta.1

v0.15.0-beta.10

v0.15.0-beta.11

v0.15.0-beta.12

v0.15.0-beta.13

v0.15.0-beta.14

v0.15.0-beta.15

v0.15.0-beta.16

v0.15.0-beta.17

v0.15.0-beta.2

v0.15.0-beta.3

v0.15.0-beta.4

v0.15.0-beta.5

v0.15.0-beta.6

v0.15.0-beta.7

v0.15.0-beta.8

v0.15.0-beta.9

v0.15.0-canary.0

v0.15.0-canary.1

v0.15.0-canary.10

v0.15.0-canary.11

v0.15.0-canary.12

v0.15.0-canary.13

v0.15.0-canary.14

v0.15.0-canary.15

v0.15.0-canary.16

v0.15.0-canary.17

v0.15.0-canary.18

v0.15.0-canary.19

v0.15.0-canary.2

v0.15.0-canary.20

v0.15.0-canary.21

v0.15.0-canary.22

v0.15.0-canary.23

v0.15.0-canary.3

v0.15.0-canary.4

v0.15.0-canary.5

v0.15.0-canary.6

v0.15.0-canary.7

v0.15.0-canary.8

v0.15.0-canary.9

v0.15.1

v0.15.1-beta.1

v0.15.2

v0.15.2-beta.1

v0.15.2-canary.1

v0.15.2-canary.2

v0.15.3

v0.15.3-beta.1

v0.15.3-beta.2

v0.15.4

v0.15.5

v0.15.5-beta.1

v0.15.6

v0.15.6-beta.1

v0.15.7

v0.15.7-beta.1

v0.16.0

v0.16.0-beta.1

v0.16.0-beta.2

v0.16.0-beta.3

v0.16.0-beta.4

v0.16.0-beta.5

v0.16.0-beta.6

v0.16.0-canary.1

v0.16.0-canary.10

v0.16.0-canary.11

v0.16.0-canary.12

v0.16.0-canary.13

v0.16.0-canary.2

v0.16.0-canary.3

v0.16.0-canary.4

v0.16.0-canary.5

v0.16.0-canary.6

v0.16.0-canary.7

v0.16.0-canary.9

v0.16.1

v0.16.1-beta.1

v0.16.1-beta.2

v0.16.2

v0.16.2-beta.1

v0.16.3

v0.16.3-beta.1

v0.16.3-beta.2

v0.16.3-beta.4

v0.16.4-beta.1

v0.16.4-beta.2

v0.17.0

v0.17.0-beta.1

v0.17.0-beta.2

v0.17.0-beta.3

v0.17.0-beta.4

v0.17.0-beta.5

v0.17.0-beta.6

v0.17.0-beta.7

v0.17.0-canary.1

v0.17.0-canary.10

v0.17.0-canary.11

v0.17.0-canary.12

v0.17.0-canary.13

v0.17.0-canary.2

v0.17.0-canary.3

v0.17.0-canary.4

v0.17.0-canary.5

v0.17.0-canary.6

v0.17.0-canary.7

v0.17.0-canary.8

v0.17.0-canary.9

v0.17.1

v0.17.1-beta.1

v0.17.1-canary.1

v0.17.2

v0.17.2-beta.1

v0.17.2-canary.1

v0.17.2-canary.2

v0.17.3

v0.17.3-beta.1

v0.17.3-canary.1

v0.17.3-canary.2

v0.18.0

v0.18.0-beta.1

v0.18.0-beta.2

v0.18.0-beta.3

v0.18.0-beta.4

v0.18.0-canary.1

v0.18.0-canary.2

v0.18.0-canary.3

v0.18.0-canary.4

v0.18.0-canary.5

v0.18.0-canary.6

v0.18.0-canary.7

v0.18.0-canary.8

v0.18.0-canary.9

v0.18.1

v0.18.1-beta.1

v0.19.0

v0.19.0-beta.1

v0.19.0-beta.2

v0.19.0-canary.1

v0.19.0-canary.10

v0.19.0-canary.11

v0.19.0-canary.12

v0.19.0-canary.2

v0.19.0-canary.3

v0.19.0-canary.4

v0.19.0-canary.5

v0.19.0-canary.6

v0.19.0-canary.7

v0.19.0-canary.8

v0.19.0-canary.9

v0.19.1

v0.19.2

v0.19.2-beta.1

v0.19.3

v0.19.3-beta.1

v0.19.3-canary.1

v0.19.4

v0.19.4-beta.1

v0.20.0

v0.20.0-beta.1

v0.20.0-beta.2

v0.20.0-beta.3

v0.20.0-beta.4

v0.20.0-beta.5

v0.20.0-beta.6

v0.20.0-beta.7

v0.20.0-beta.8

v0.20.0-canary.1

v0.20.0-canary.10

v0.20.0-canary.11

v0.20.0-canary.12

v0.20.0-canary.13

v0.20.0-canary.14

v0.20.0-canary.15

v0.20.0-canary.16

v0.20.0-canary.2

v0.20.0-canary.3

v0.20.0-canary.4

v0.20.0-canary.5

v0.20.0-canary.6

v0.20.0-canary.7

v0.20.0-canary.8

v0.20.0-canary.9

v0.20.1

v0.20.1-beta.1

v0.20.1-beta.2

v0.20.2

v0.20.2-beta.1

v0.20.3

v0.20.3-beta.1

v0.20.3-canary.1

v0.20.3-canary.2

v0.20.5-canary.2

v0.21.0

v0.21.0-beta.1

v0.21.0-beta.2

v0.21.0-beta.3

v0.21.0-beta.4

v0.21.0-canary.1

v0.21.0-canary.10

v0.21.0-canary.11

v0.21.0-canary.12

v0.21.0-canary.13

v0.21.0-canary.14

v0.21.0-canary.2

v0.21.0-canary.3

v0.21.0-canary.4

v0.21.0-canary.5

v0.21.0-canary.6

v0.21.0-canary.7

v0.21.0-canary.8

v0.21.0-canary.9

v0.21.1

v0.21.1-beta.1

v0.21.1-canary.1

v0.21.2

v0.21.2-beta.1

v0.21.2-canary.1

v0.21.3

v0.21.3-beta.1

v0.21.3-canary.1

v0.22.0

v0.22.0-beta.1

v0.22.0-beta.2

v0.22.0-beta.3

v0.22.0-beta.4

v0.22.0-beta.5

v0.22.0-canary.1

v0.22.0-canary.2

v0.22.0-canary.3

v0.22.0-canary.4

v0.22.0-canary.5

v0.22.0-canary.6

v0.22.0-canary.7

v0.22.1

v0.22.2

v0.22.2-beta.1

v0.22.2-canary.1

v0.22.3

v0.22.4

v0.22.4-beta.1

v0.23.0

v0.23.0-beta.1

v0.23.0-beta.10

v0.23.0-beta.11

v0.23.0-beta.13

v0.23.0-beta.14

v0.23.0-beta.15

v0.23.0-beta.16

v0.23.0-beta.17

v0.23.0-beta.2

v0.23.0-beta.3

v0.23.0-beta.4

v0.23.0-beta.5

v0.23.0-beta.7

v0.23.0-beta.8

v0.23.0-beta.9

v0.23.0-canary.1

v0.23.0-canary.2

v0.23.1

v0.23.1-beta.1

v0.23.2

v0.23.2-beta.1

v0.23.2-beta.2

v0.24.0

v0.24.0-beta.1

v0.24.0-beta.2

v0.24.0-beta.3

v0.24.0-beta.4

v0.24.0-beta.5

v0.24.0-beta.6

v0.24.0-beta.7

v0.24.0-beta.8

v0.24.1

v0.24.1-beta.1

v0.24.2

v0.25.0

v0.25.0-beta.0

v0.25.0-beta.1

v0.25.0-beta.2

v0.25.0-beta.3

v0.25.0-beta.4

v0.25.0-beta.5

v0.25.1

v0.25.1-beta.0

v0.25.3

v0.25.3-beta.0

v0.25.4

v0.25.5

v0.25.5-beta.0

v0.25.6

v0.25.6-beta.0

v0.25.7

v0.25.7-beta.0

v0.26.0

v0.26.0-beta.0

v0.26.0-beta.1

v0.26.0-beta.10

v0.26.0-beta.11

v0.26.0-beta.2

v0.26.0-beta.3

v0.26.0-beta.4

v0.26.0-beta.5

v0.26.0-beta.6

v0.26.0-beta.7

v0.26.0-beta.8

v0.26.0-beta.9

v0.26.1

v0.26.1-beta.0

v0.26.1-beta.1

v0.26.2

v0.26.2-beta.0

v0.26.3

v0.26.3-beta.0

v0.26.3-beta.1

v0.26.3-beta.2

v0.26.3-beta.3

v0.26.3-beta.4

v0.26.4-beta.0

v0.27.0-beta.0

v0.27.0-beta.1

v0.5.0-canary.0

v0.5.1

v0.5.2

v0.5.3

v0.5.4-beta.0

v0.5.4-canary.0

v0.5.4-canary.1

v0.5.4-canary.10

v0.5.4-canary.11

v0.5.4-canary.12

v0.5.4-canary.13

v0.5.4-canary.14

v0.5.4-canary.15

v0.5.4-canary.16

v0.5.4-canary.17

v0.5.4-canary.18

v0.5.4-canary.19

v0.5.4-canary.2

v0.5.4-canary.20

v0.5.4-canary.21

v0.5.4-canary.22

v0.5.4-canary.23

v0.5.4-canary.24

v0.5.4-canary.25

v0.5.4-canary.26

v0.5.4-canary.27

v0.5.4-canary.28

v0.5.4-canary.29

v0.5.4-canary.3

v0.5.4-canary.30

v0.5.4-canary.31

v0.5.4-canary.4

v0.5.4-canary.5

v0.5.4-canary.6

v0.5.4-canary.7

v0.5.4-canary.8

v0.5.4-canary.9

v0.6.0-canary.0

v0.6.0-canary.1

v0.6.0-canary.2

v0.6.0-canary.3

v0.6.0-canary.4

v0.6.0-canary.5

v0.6.0-canary.6

v0.6.0-canary.7

v0.6.0-canary.8

v0.7.0-canary.0

v0.7.0-canary.1

v0.7.0-canary.10

v0.7.0-canary.11

v0.7.0-canary.12

v0.7.0-canary.13

v0.7.0-canary.14

v0.7.0-canary.15

v0.7.0-canary.16

v0.7.0-canary.17

v0.7.0-canary.18

v0.7.0-canary.19

v0.7.0-canary.2

v0.7.0-canary.20

v0.7.0-canary.22

v0.7.0-canary.23

v0.7.0-canary.24

v0.7.0-canary.25

v0.7.0-canary.26

v0.7.0-canary.27

v0.7.0-canary.28

v0.7.0-canary.29

v0.7.0-canary.3

v0.7.0-canary.30

v0.7.0-canary.31

v0.7.0-canary.32

v0.7.0-canary.33

v0.7.0-canary.34

v0.7.0-canary.35

v0.7.0-canary.36

v0.7.0-canary.37

v0.7.0-canary.38

v0.7.0-canary.39

v0.7.0-canary.4

v0.7.0-canary.40

v0.7.0-canary.41

v0.7.0-canary.42

v0.7.0-canary.43

v0.7.0-canary.44

v0.7.0-canary.45

v0.7.0-canary.46

v0.7.0-canary.47

v0.7.0-canary.48

v0.7.0-canary.49

v0.7.0-canary.5

v0.7.0-canary.50

v0.7.0-canary.51

v0.7.0-canary.52

v0.7.0-canary.53

v0.7.0-canary.54

v0.7.0-canary.55

v0.7.0-canary.56

v0.7.0-canary.57

v0.7.0-canary.58

v0.7.0-canary.59

v0.7.0-canary.6

v0.7.0-canary.7

v0.7.0-canary.8

v0.7.0-canary.9

v0.8.0-canary.0

v0.8.0-canary.1

v0.8.0-canary.10

v0.8.0-canary.11

v0.8.0-canary.12

v0.8.0-canary.13

v0.8.0-canary.14

v0.8.0-canary.15

v0.8.0-canary.16

v0.8.0-canary.17

v0.8.0-canary.18

v0.8.0-canary.19

v0.8.0-canary.2

v0.8.0-canary.20

v0.8.0-canary.21

v0.8.0-canary.22

v0.8.0-canary.23

v0.8.0-canary.24

v0.8.0-canary.25

v0.8.0-canary.26

v0.8.0-canary.27

v0.8.0-canary.28

v0.8.0-canary.29

v0.8.0-canary.3

v0.8.0-canary.30

v0.8.0-canary.31

v0.8.0-canary.32

v0.8.0-canary.33

v0.8.0-canary.34

v0.8.0-canary.4

v0.8.0-canary.5

v0.8.0-canary.6

v0.8.0-canary.7

v0.8.0-canary.8

v0.8.0-canary.9

v0.9.0-beta.2

v0.9.0-canary.0

v0.9.0-canary.1

v0.9.0-canary.10

v0.9.0-canary.11

v0.9.0-canary.12

v0.9.0-canary.13

v0.9.0-canary.2

v0.9.0-canary.3

v0.9.0-canary.5

v0.9.0-canary.6

v0.9.0-canary.7

v0.9.0-canary.8

v0.9.0-canary.9

v2026.*

v2026.3.1-canary.906

v2026.3.11-canary.915

v2026.3.13-canary.913

v2026.3.15-canary.910

v2026.3.16-canary.924

v2026.3.18-canary.918

v2026.3.2-canary.1225

v2026.3.2-canary.917

v2026.3.20-canary.913

v2026.3.30-canary.932

v2026.3.6-canary.912

v2026.3.9-canary.917

v2026.4.10-canary.928

v2026.4.5-canary.916

v2026.4.6-canary.929

v2026.4.7-canary.925

v2026.4.9-canary.928

v2026.5.10-canary.931

v2026.5.11-canary.1015

v2026.5.12-canary.955

v2026.5.13-canary.954

v2026.5.14-canary.948

v2026.5.15-canary.954

v2026.5.16-canary.932

v2026.5.18-canary.1028

v2026.5.20-canary.1007

v2026.5.21-canary.1015

v2026.5.22-canary.1005

v2026.5.24-canary.937

v2026.5.25-canary.1032

v2026.5.28-canary.1026

v2026.5.31-canary.952

v2026.5.6-canary.947

v2026.5.7-canary.951

v2026.5.9-canary.931

v2026.6.10-canary.1025

v2026.6.11-canary.1031

v2026.6.15-canary.1103

v2026.6.17-canary.1033

v2026.6.18-canary.1034

v2026.6.19-canary.1031

v2026.6.2-canary.1033

v2026.6.20-canary.1001

v2026.6.22-canary.1054

v2026.6.23-canary.1015

v2026.6.24-canary.1005

v2026.6.25-canary.1003

v2026.6.3-canary.1038

v2026.6.4-canary.1018

v2026.6.7-canary.1000

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59262.json"