CVE-2026-50885

Vulnerability

A flaw in the ACL evaluation for share-based read endpoints in Sismics Docs (Teedy) version 1.11 allows an attacker to bypass authorization checks. The BaseResource.getTargetIdList(shareId) method appends the untrusted share query parameter directly to the ACL target list. The AclDao.checkPermission(...) method calls SecurityUtil.skipAclCheck(targetIdList), which returns true when the target list contains the literal identifiers admin or administrators. Because the request-controlled share value can be one of these reserved strings, read authorization is skipped without requiring a valid share object. Affected read paths include document view, file list, file download, file ZIP export, exported document output, and comment listing. [1]

Exploitation

An unauthenticated attacker only needs to know a valid document or file identifier (e.g., a documentId or fileId) that should not be accessible. The attacker sends a read request to an affected endpoint (e.g., GET /api/document/?share=admin or GET /api/file//data?share=administrators). The server evaluates the ACL target list containing the reserved string, skips the actual ACL check, and returns the protected data. No prior authentication or valid share token is required. [1]

Impact

Successful exploitation grants unauthorized read access to document metadata, comments, attachment listings, exported PDFs, and file contents from share-capable read endpoints. An attacker can retrieve sensitive information stored in Teedy documents without any valid credentials. [1]

Mitigation

No fix or patch has been disclosed in the available reference. Users of Sismics Docs (Teedy) v1.11 should monitor for official updates. As a workaround, if source code access is available, the SecurityUtil.skipAclCheck function could be modified to reject reserved strings from untrusted input, or the share parameter could be validated against known share objects before being added to the target list. The vulnerability is not listed in CISA KEV as of publication. [1]