Reference for CVE-2026-50885

CVE-2026-50885.md

Summary

Sismics Docs (Teedy) 1.11 merges the untrusted share query parameter into ACL target evaluation for read endpoints. An unauthenticated or low-privileged requester who knows a valid document or file identifier can use reserved administrator target values to bypass read authorization.

Details

Anonymous requests receive an AnonymousPrincipal, so share-capable read paths still build an ACL target list. BaseResource.getTargetIdList(shareId) appends the raw share value to that list.

AclDao.checkPermission(...) calls SecurityUtil.skipAclCheck(targetIdList) before checking ACL rows. SecurityUtil.skipAclCheck(...) returns true when the target list contains the literal identifiers admin or administrators.

Because the request-controlled share value can be one of those reserved strings, read authorization is skipped without requiring a real share object. The affected read paths include document view, file list, file download, file ZIP export, exported document output, and comment listing.

PoC

1. Identify a valid Teedy 1.11 documentId or fileId that the requester should not be allowed to read.
2. Send the corresponding read request without a valid share value, such as GET /api/document/<document-id> or GET /api/file/<file-id>/data, and observe access denial.
3. Repeat the request with share=admin, for example GET /api/document/<document-id>?share=admin or GET /api/file/<file-id>/data?share=admin.
4. Observe that the server returns protected metadata, file content, comments, attachment listings, or exported output instead of requiring a valid share token.
5. Repeat with share=administrators and observe the same ACL shortcut behavior.

Impact

The observed result is unauthorized read access to Teedy document data when the attacker knows a valid object identifier. Exposed data can include document metadata, comments, attachment lists, exported PDFs, and file contents from share-capable read endpoints.