Medium severity6.5OSV Advisory· Published Jul 8, 2026· Updated Jul 10, 2026

CVE-2026-59262

Description

AFFiNE's histories GraphQL field fails to validate Doc.Read permission before exposing document edit history, allowing authenticated workspace members to retrieve restricted content timelines. Attackers can supply arbitrary document GUIDs to access full edit histories including user names, emails, and timestamps of private pages they lack access to.

Affected products

Toeverything/AffineOSV2 versions
v0.27.0-beta.1, v2026.6.25-canary.1003, v0.27.0-beta.0, …+ 1 more
- (no CPE)range: v0.27.0-beta.1, v2026.6.25-canary.1003, v0.27.0-beta.0, …
- (no CPE)

Patches

Vulnerability mechanics

References

github.com/toeverything/AFFiNE/commit/1f0bcd01a37a522393fc1b288395e3a72a79ccadnvd
github.com/toeverything/AFFiNE/issues/15179nvd
www.vulncheck.com/advisories/affine-unauthorized-document-edit-history-access-via-graphql-histories-fieldnvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000