This vulnerability in toeverything AFFiNE (up to version 0.26.3) involves an authorization bypass in the allowDocPreview function within the Public Markdown Preview Endpoint (/workspace/:workspaceId/:docId). The flaw allows remote attackers to bypass authorization checks, potentially accessing document previews without proper permissions. The issue is confirmed and publicly disclosed with a CVSS 4.0 score of 6.9, indicating a medium severity risk. The vendor has not issued any patch or official remediation, and the exploit is publicly available, increasing the risk of exploitation.

Successful exploitation of this vulnerability allows unauthorized remote users to bypass authorization controls and access document previews they should not have permission to view. This could lead to unauthorized disclosure of sensitive information contained in documents accessible via the affected endpoint. There is no indication of privilege escalation or further system compromise beyond unauthorized document preview access.

No official patch or remediation is currently available from the vendor, and the vendor has not responded to disclosure attempts. Users should monitor vendor channels for updates and consider restricting access to the affected endpoint or implementing additional access controls as a temporary mitigation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.