Mayan EDMS ACLs must cover the API, document type and stored credentials
Mayan EDMS is a document management platform with fine-grained permissions, roles, groups, document types, workflow states and a REST API. The visible document list is only one view of access. A document can be reachable through a type-level permission, a source, a batch operation or an API endpoint.
The Mayan documentation describes a permission system plus per-object grants. Version notes explain that API permission behavior was aligned with HTTP views when creating cabinets. The current feature documentation also describes role-based use of stored credentials and API access. Those controls should be tested together.
Measurement evidence
On 2026-11-07 UTC, page-one count-only ZoomEye probes with sub_type=all returned 2 matches for app="Mayan EDMS", 783 for title="Mayan EDMS" and 1,080 for http.body="Mayan EDMS". The title and body counts can include documentation and integration pages, so the small app count is a better starting filter but not a security conclusion.
Build a permission matrix
Record roles, groups, users, document types, cabinets and per-object ACLs. Test a viewer, an editor, a workflow approver and an administrator against the same document. Repeat through the web UI and the REST API. Check download, version, metadata, signature and deletion operations separately.
Document-type ACLs are efficient because one rule can cover many documents, but they also broaden the blast radius. A change to a type ACL can expose every document classified under that type. Per-object grants can create exceptions that survive a type-level review, so keep an index of those exceptions.
Protect credentials and integrations
The feature documentation describes a dedicated permission for stored credentials. Treat credentials used for external storage, signing or OpenAI integration as a separate secret class. Review which roles can use them and which roles can change their configuration. An API token embedded in a workflow or source connector should have an owner and an expiry.
OIDC can centralize login, but the EDMS still decides what the authenticated identity may do. Test that disabling an identity provider account also invalidates the application session according to policy, and inspect API tokens that do not use OIDC.
Monitor permission changes, document exports, bulk downloads, ACL edits and failed API calls. After an exposure, preserve the document audit history, revoke API credentials and review the type and object ACLs involved. Do not change the login page and assume the document boundary is repaired.
Top comments (0)