Security readout for executives and security teams
Plain-English summary
CVE-2026-23630 affects Docmost, an open-source wiki/documentation platform. A user who can create or edit content could store a malicious Mermaid diagram that runs script in another viewer’s browser. This is a business risk for internal knowledge bases because it can affect trusted users viewing normal documentation pages.
Executive priority
Prioritize remediation for Docmost instances used by many staff or allowing broad editing. This is not described as actively exploited, but stored XSS in documentation systems can undermine user trust and expose sessions or sensitive workspace data.
Technical view
Docmost versions 0.3.0 through 0.23.2 render attacker-controlled Mermaid content with mermaid.render() and insert returned SVG/HTML using dangerouslySetInnerHTML without sanitization. Mermaid init directives can lower security settings and enable HTML labels, allowing stored XSS. The issue is fixed in Docmost 0.24.0.
Likely exposure
Exposure is limited to Docmost deployments running versions >=0.3.0 and <0.24.0 where untrusted or lower-privileged users can create or edit pages containing Mermaid code blocks.
Exploitation context
The source bundle does not indicate known active exploitation, and KEV is false. Exploitation requires Docmost write access and a victim who views the affected content. Impact is browser-side script execution in the viewer’s Docmost session context.
Researcher notes
The advisory attributes the flaw to unsafe Mermaid rendering and unsanitized DOM insertion. CVSS v4.0 score is 6.3 with low attack complexity, low privileges required, and user interaction present. Avoid assuming server-side compromise; the stated impact is stored browser-side XSS.
Mitigation direction
- Upgrade Docmost to version 0.24.0 or later.
- Review vendor advisory and release notes before deployment.
- Restrict content editing rights until upgraded, especially in shared or semi-public workspaces.
- Check vendor guidance for any additional hardening or backport information.
Validation and detection
- Inventory Docmost instances and confirm running versions.
- Identify instances on versions 0.3.0 through 0.23.2.
- Review whether Mermaid code blocks are enabled and used.
- Confirm upgrade to 0.24.0 or later in package, container, or deployment metadata.
- Review recent editable pages for unexpected Mermaid content if untrusted editing was allowed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-116: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-23630 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
6.3MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/docmost/docmost/security/advisories/GHSA-r4hj-mc62-jmwjCVE reference · x_refsource_CONFIRM
- https://github.com/docmost/docmost/commit/cb9f27da9a8b4940760e37e5238a1eb91e427dafCVE reference · x_refsource_MISC
- https://github.com/docmost/docmost/releases/tag/v0.24.0CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Encoding or Escaping of Output
Improper Encoding or Escaping of Output represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.