CVE-2025-79927: Unauthenticated Enumeration of Public Documents via Predictable Search Path

Vulnerability Summary: Unauthenticated Enumeration of Public Documents via Predictable Search Paths Overview Vulnerability Type: Unauthenticated Enumeration Severity: Moderate (Moderate) - CVSS 3.1 Base Score 6.5 CVE ID: CVE-2025-79927 Description: The endpoint accepts an optional parameter to restrict the search scope to descendants of a specific document. The Issue: When the parameter is provided, the request is served directly from the database without requiring an access token (tokenless). The code only checks if the document is , but does not verify if the caller has permission to access the document. Root Cause: 1. Predictable Scope: The consists of short sequences (e.g., ), making it easy to enumerate. 2. Unfiltered Results: An empty search term disables title filtering, resulting in the return of the entire subtree, including the ID of every document. Scope Affected Versions: Fixed Version: Specific Impacts: Confidentiality Leakage: Attackers can obtain identifiers, titles, creators, timestamps, tree structures, and content of all public documents. Existence Oracle: Attackers can determine whether a guessed path contains a document based on the status code (200 vs 404), even if no content is returned. Broader Access: The same technique can be used to enumerate documents of authenticated users (logged-in users), provided their paths are authenticated (not just public). Limitations: Subject to rate limiting (approximately 80 requests/minute/IP), but this does not prevent the attack. Remediation 1. Scope by Secret rather than Guessable Numbers: Have clients pass the random UUID of the parent, and resolve its path on the server side. Guessing a UUID is cryptographically infeasible, whereas guessing a sequence path is trivial. 2. Defense in Depth: Return for inaccessible paths to eliminate the existence oracle. Add regression tests to confirm that anonymous users cannot retrieve public subtrees by guessing paths. POC Code / Exploit Code Step 1: Normal Anonymous Search (Expected Behavior) Response: Step 2: Providing Path Parameter (Vulnerability Triggered) Response: Step 3: Iterate Path**

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-79927: Unauthenticated Enumeration of Public Documents via Predictable Search Path

More from this source