CVE-2026-50885: Incorrect access control in the share-based read endpoints of Sismics Docs (Teedy) v1

Synopsis

Incorrect access control in the share-based read endpoints of Sismics Docs (Teedy) v1.11 allows an unauthenticated, network-based attacker to reach endpoints that should be restricted, by sending a crafted HTTP request. No authentication is required, and no user interaction is needed. Successful exploitation gives the attacker read access to sensitive document data. No fix version has been published yet; HarborGuard tracks this advisory and will make a patched rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoints are exposed over the network, so the attacker must be able to reach the Teedy service via HTTP/HTTPS.

• AuthenticationNot required

  No credentials or session token are needed; the attacker can send the crafted request as an anonymous caller.

• Victim interactionNot required

  The attacker interacts directly with the server; no user action such as clicking a link or opening a file is required.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and reproducible without depending on race conditions or specific environmental configurations.

Blast Radius

• An attacker reads documents and files stored in the Teedy instance that should be access-controlled behind share permissions.
• Sensitive endpoint responses, which may include document metadata, file contents, and user-associated records, are exposed in full.
• Because confidentiality impact is rated High and no authentication barrier exists, a single crafted request can return data across multiple restricted resources.