Vulnerabilities

TI-2026-42402 CVE-2026-59262 · GHSA-m4gp-5xh5-xhq4

AFFiNE - Unauthorized Document Edit History Access via GraphQL histories Field

MEDIUM 64

AFFiNE's histories GraphQL field fails to validate Doc.Read permission before exposing document edit history, allowing authenticated workspace members to retrieve restricted content timelines.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00415 Published 2026-07-08 Fixed in 0.26.3 CWE-862

TI-2026-20588 CVE-2026-25477

AFFiNE: Open Redirect via Regex Bypass in redirect-proxy

MEDIUM 64

AFFiNE is an open-source, all-in-one workspace and an operating system.

CVSS 4.0MEDIUM 6.9 Network No auth User interaction EPSS 0.00202 Published 2026-03-02 Fixed in 0.26.0 CWE-601

TI-2026-17555 CVE-2026-21853

AFFiNE: One-click Remote Code Execution through Custom URL Handling

HIGH 73

AFFiNE is an open-source, all-in-one workspace and an operating system.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00713 Published 2026-03-02 Fixed in 0.25.4 CWE-94

Vulnerabilities

Filters

AFFiNE - Unauthorized Document Edit History Access via GraphQL histories Field

AFFiNE: Open Redirect via Regex Bypass in redirect-proxy

AFFiNE: One-click Remote Code Execution through Custom URL Handling