The vulnerability in toeverything AFFiNE (up to version 0.26.3) resides in the allowDocPreview function of the /workspace/:workspaceId/:docId endpoint within the Public Markdown Preview component. This flaw permits remote attackers to bypass authorization checks, potentially allowing unauthorized access to document previews. The issue is publicly disclosed with exploit code available, but the vendor has not issued any fix or advisory. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low impact on confidentiality.

Successful exploitation allows an attacker to bypass authorization controls remotely and access document previews without proper permissions. This could lead to unauthorized disclosure of sensitive information contained in documents accessible via the affected endpoint. There is no indication of privilege escalation, integrity, or availability impact. No confirmed exploitation in the wild has been reported.

No official patch or remediation is currently available from the vendor, who has not responded to the disclosure. Users should monitor the vendor's channels for any future updates or fixes. Until a fix is released, consider restricting access to the affected endpoint or implementing additional access controls at the network or application level to mitigate unauthorized access risks.