CVE-2026-59262

mediumCVSS 6.5covered by 1 sourcefirst seen 2026-07-08

AFFiNE's histories GraphQL field fails to validate Doc.Read permission before exposing document edit history, allowing authenticated workspace members to retrieve restricted content timelines. Attackers can supply arbitrary document GUIDs to access full edit histories including user names, emails, and timestamps of private pages they lack access to.

⚡ Watch CVE-2026-59262

Get an email if CVE-2026-59262 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.24% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 15% of all EPSS-scored CVEs.

Advisory coverage (1)

mediumCVE-2026-59262: AFFiNE's histories GraphQL field fails to validate Doc.Read permission before exposing documen…nvd · 2026-07-08

External references

NVD record for CVE-2026-59262

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-59262 status](https://www.csirts.com/badge/CVE-2026-59262)](https://www.csirts.com/cve/CVE-2026-59262)