Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-08T15:44:07 AFFiNE: AFFiNE: Information disclosure via histories GraphQL field 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CWE-639

AFFiNE's histories GraphQL field fails to validate Doc.Read permission before exposing document edit history, allowing authenticated workspace members to retrieve restricted content timelines. Attackers can supply arbitrary document GUIDs to access full edit histories including user names, emails, and timestamps of private pages they lack access to.

A flaw was found in AFFiNE. This vulnerability allows an authenticated workspace member to bypass document read permissions by supplying arbitrary document Globally Unique Identifiers (GUIDs) to the histories GraphQL field. This can lead to information disclosure, enabling attackers to retrieve full edit histories, including user names, emails, and timestamps, of private pages they are not authorized to access.

This Moderate impact information disclosure flaw in AFFiNE allows authenticated workspace members to bypass document read permissions. By supplying arbitrary document GUIDs to the histories GraphQL field, attackers can retrieve full edit histories, including user names, emails, and timestamps, of private pages they are not authorized to access. This issue primarily affects deployments of AFFiNE and does not directly impact Red Hat products. Red Hat AI Inference Server Not affected rhaiis/vllm-cpu-rhel9 Red Hat AI Inference Server Not affected rhaiis/vllm-cuda-rhel9 Red Hat AI Inference Server Not affected rhaiis/vllm-rocm-rhel9 Red Hat AI Inference Server Not affected rhaiis/vllm-tpu-rhel9 Red Hat AI Inference Server Not affected rhaii/vllm-cpu-rhel9 Red Hat AI Inference Server Not affected rhaii/vllm-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Not affected rhelai3/bootc-aws-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Not affected rhelai3/bootc-azure-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Not affected rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Not affected rhelai3/bootc-gcp-cuda-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-mlflow-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-59262 https://nvd.nist.gov/vuln/detail/CVE-2026-59262 https://github.com/toeverything/AFFiNE https://github.com/toeverything/AFFiNE/commit/1f0bcd01a37a522393fc1b288395e3a72a79ccad https://github.com/toeverything/AFFiNE/issues/15179 https://www.vulncheck.com/advisories/affine-unauthorized-document-edit-history-access-via-graphql-histories-field