The vulnerability in AFFiNE's monorepo arises from a missing authorization check on the histories GraphQL field. This field fails to validate whether the requesting user has Doc.Read permission before returning document edit histories. As a result, any authenticated member of a workspace can supply arbitrary document GUIDs to retrieve complete edit histories, including sensitive user information and timestamps, for documents they are not authorized to view. This leads to unauthorized information disclosure of private document metadata.

The vulnerability allows authenticated workspace members to bypass access controls and retrieve sensitive edit history information of private documents. This includes user names, email addresses, and timestamps associated with document edits. The exposure of this data can lead to privacy violations and potential information leakage within the affected organization. There is no indication of privilege escalation or code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Until a patch is available, restrict access to authenticated workspace members carefully and monitor for suspicious access patterns related to document histories.