CVE-2026-42889

{
  "id": "CVE-2026-42889",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-12T20:16:42.143",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Relay adds real-time collaboration to Obsidian. Relay Server versions 0.9.0 through 0.9.6 contain an authentication bypass in the multi-document WebSocket endpoints. When authentication is configured, WebSocket connections without a token query parameter were incorrectly treated as having full server permissions. An unauthenticated network attacker who knows or guesses a document ID could connect to the document sync WebSocket and read or modify document contents without a valid document token. This vulnerability is fixed in 0.9.7."
    },
    {
      "lang": "es",
      "value": "Relay añade colaboración en tiempo real a Obsidian. Relay Server versiones 0.9.0 a 0.9.6 contienen una omisión de autenticación en los puntos finales WebSocket multidocumento. Cuando la autenticación está configurada, las conexiones WebSocket sin un parámetro de consulta de token fueron tratadas incorrectamente como si tuvieran permisos completos de servidor. Un atacante de red no autenticado que conoce o adivina un ID de documento podría conectarse al WebSocket de sincronización de documentos y leer o modificar el contenido del documento sin un token de documento válido. Esta vulnerabilidad está corregida en 0.9.7."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "No-Instructions",
          "product": "relay-server",
          "versions": [
            {
              "version": ">= 0.9.0, < 0.9.7",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-13T12:32:29.545243Z",
          "id": "CVE-2026-42889",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        },
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/No-Instructions/relay-server/security/advisories/GHSA-9vp9-8q9j-8mqm",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/No-Instructions/relay-server/security/advisories/GHSA-9vp9-8q9j-8mqm",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}