No-Instructions relay-server versions 0.9.0 to 0.9.6 contain an incorrect authorization vulnerability (CWE-863) in their multi-document WebSocket endpoints. When authentication is enabled, WebSocket connections missing a token query parameter are incorrectly treated as fully authorized, enabling unauthenticated attackers to access and modify document data by connecting to the document sync WebSocket with a known or guessed document ID. This flaw allows unauthorized read and write access to documents. The issue is resolved in relay-server version 0.9.7.

An unauthenticated network attacker can bypass authentication controls and gain full read and write access to documents synchronized via the relay-server WebSocket endpoints. This compromises confidentiality and integrity of document contents. Availability is not impacted. The CVSS 3.1 base score is 9.1 (critical), reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality and integrity.

This vulnerability is fixed in No-Instructions relay-server version 0.9.7. Users should upgrade to version 0.9.7 or later to remediate this issue. Patch status is not explicitly stated in the vendor advisory content provided, but the description confirms the fix in 0.9.7. Until upgraded, restrict network access to the relay-server WebSocket endpoints to trusted users only.