The vulnerability in AFFiNE's monorepo arises from missing authorization checks on the histories GraphQL field. Specifically, the system fails to verify that a user has Doc.Read permission before returning the edit history of documents. As a result, any authenticated member of a workspace can supply arbitrary document GUIDs to retrieve complete edit histories, including sensitive metadata such as user names, emails, and timestamps, even for private documents they are unauthorized to view. This represents an information disclosure vulnerability with a CVSS 4.0 base score of 7.1 (high severity). No vendor advisory or patch information is currently available, and the product is not a cloud service, so remediation depends on vendor action or user mitigation.

Authenticated workspace members can retrieve sensitive edit history information for documents they do not have permission to access. This includes user identities (names and emails) and timestamps related to document edits on private pages. The exposure of this information can lead to privacy violations and potential further targeted attacks based on disclosed user data. There is no indication of privilege escalation or remote code execution, but the confidentiality of restricted content timelines is compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is currently documented, organizations should restrict workspace membership to trusted users and monitor access to sensitive documents. Avoid sharing document GUIDs publicly and consider limiting GraphQL API access where feasible until a patch is released.