PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-7702 toeverything CVE debrief

A vulnerability was detected in toeverything AFFiNE up to 0.26.3. This issue affects the function allowDocPreview of the file /workspace/:workspaceId/:docId of the component Public Markdown Preview Endpoint. The manipulation results in authorization bypass. It is possible to launch the attack remotely. The exploit is now public and may be used. Defenders should assess exposure and verify authorization controls. The vulnerability allows for remote authorization bypass via the Public Markdown Preview Endpoint.

Vendor
toeverything
Product
AFFiNE
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-03
Original CVE updated
2026-10-26
Advisory published
2026-05-03
Advisory updated
2026-10-26

Who should care

Defenders responsible for AFFiNE instances, especially those with public-facing endpoints, should assess exposure and verify the effectiveness of current authorization controls. This includes reviewing the current authorization controls and ensuring that they are effective in preventing exploitation. Additionally, defenders should prioritize verifying exposure of AFFiNE instances and assessing the effectiveness of current authorization controls due to the

Why it matters

Defenders should prioritize verifying exposure of AFFiNE instances, especially those with public-facing endpoints, and assess the effectiveness of current authorization controls due to the public availability of the exploit and potential for authorization bypass.

  • Verify exposure of AFFiNE instances with public-facing endpoints
  • Assess effectiveness of current authorization controls
  • Monitor for potential exploitation attempts

Technical summary

The vulnerability affects the Public Markdown Preview Endpoint in toeverything AFFiNE up to 0.26.3, allowing for authorization bypass. The exploit is now public and may be used. The vulnerability allows for remote authorization bypass via the Public Markdown Preview Endpoint. Defenders should prioritize verifying exposure of AFFiNE instances and assess the effectiveness of current authorization controls. The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions.

Defensive priority

Defenders should prioritize verifying exposure of AFFiNE instances, especially those with public-facing endpoints, and assess the effectiveness of current authorization controls.

Recommended defensive actions

  • Verify exposure of AFFiNE instances, especially those with public-facing endpoints
  • Assess the effectiveness of current authorization controls
  • Monitor for potential exploitation attempts
  • Review compensating controls for exposed systems
  • Check relevant monitoring, detection, and logs for exposed assets
  • Track exceptions, retest remediated assets
  • Plan vendor-supported updates or mitigations

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, the vendor did not respond to early disclosure, and the exploit is now public.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-7702 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-7702

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-7702 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-7702

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.