CVE-2026-85697

Documenso 2.17.0 contains an access control flaw (CWE-863, incorrect authorization) in the endpoint that serves PDF documents: it fails to validate document visibility settings and does not verify that the requester owns or is authorized to view the document being requested. A low-privileged authenticated user who knows or guesses a document's data identifier can request that document's PDF and retrieve it even when visibility settings should restrict it, including documents in other teams or tenants. The attacker gains read access to restricted signed documents, a confidentiality-only impact, with no ability to modify or disrupt anything (CVSS 4.0 confidentiality impact is high while integrity and availability impacts are none). Any organization running Documenso 2.17.0, particularly multi-team or multi-tenant deployments where documents are meant to be team-restricted, is exposed. There is no public proof-of-concept, the issue is not in CISA KEV, and EPSS puts 30-day exploitation probability at just 0.3% (23rd percentile), so no exploitation is currently known.

What to do: Upgrade to the latest Documenso release beyond 2.17.0 as soon as a patched build is available, and monitor the vendor's GitHub security advisories for the fixed version since the advisory data does not name one. In the meantime, restrict and audit access to the PDF-serving endpoint, review team/tenant document sharing and visibility settings, and check access logs for low-privileged accounts fetching documents outside their team or tenant.