Access Control Vulnerability in Documenso PDF Endpoint

CVE-2026-85697

What is CVE-2026-85697?

Documenso version 2.17.0 is affected by an access control vulnerability in its PDF-serving endpoint. The flaw stems from inadequate validation of document visibility settings, allowing users with low privileges to access restricted documents. This issue can be exploited by attackers to read documents that are meant to be confidential either within their own team or across different tenants. The lack of ownership validation on document data identifiers significantly increases the risk of unauthorized information disclosure.

References