CVE-2026-59262

Medium

Description

AFFiNE's histories GraphQL field fails to validate Doc.Read permission before exposing document edit history, allowing authenticated workspace members to retrieve restricted content timelines. Attackers can supply arbitrary document GUIDs to access full edit histories including user names, emails, and timestamps of private pages they lack access to.

SeverityMedium

CVSS6.5

Exploit probability—

ProductAffine Monorepo

PublishedJul 8, 2026

First seenJul 8, 2026

Weakness typeCWE-862Missing authorization

How to fix

Update

affine monorepo0.26.3 or later

Patches

github.com/toeverything/AFFiNE/commit/1f0bcd01a37a522393fc1b288395e3a72a79ccad

Affected products

Product	Affected versions	Fixed in
affine monorepo	v < 0.26.3, v ≤ 1f0bcd0	0.26.3

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.