CVE-2026-92800

Docs before 5.4.1 fails to terminate established WebSocket collaboration sessions when a user's access is revoked at the parent document level (CWE-613, improper session expiration). The flaw is triggered when an administrator revokes a user's access to a parent document while that user still holds open WebSocket connections to its sub-documents; those connections are never disconnected. Because the CVSS 4.0 vector rates attack complexity high with present attack requirements (AC:H/AT:P) and low privileges required, the revoked user must generally have an active session at the moment access is cut, but once that condition holds they retain real-time read and write access to the sub-documents indefinitely. Any deployment running an affected version that uses WebSocket-based collaboration with hierarchical parent/sub-document permissions is exposed. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is currently known.

What to do: Upgrade to Docs 5.4.1 or later. As an interim mitigation, restart the WebSocket/collaboration service after revoking a user's parent-document access to force stale sessions to close, and audit logs for reads or edits performed by recently de-provisioned users. When revoking access, verify that the user's sub-document sessions are actually terminated rather than left open.