LOW 2.3 NVD
CVE-2026-111169
La Suite Docs through 6.0.0 contains an authorization bypass vulnerability that allows authenticated users to write comments into threads of documents they cann
La Suite Docs through 6.0.0 contains an authorization bypass vulnerability that allows authenticated users to write comments into threads of documents they cannot access. Attackers who know a thread UUID can route a POST comment request through their own document's resource_id, inserting comments into another document's thread without access.
References
- https://github.com/suitenumerique/docs
- https://github.com/suitenumerique/docs/blob/dbf8fece4e72292443dc71ff173593551203d011/src/b
- https://github.com/suitenumerique/docs/blob/dbf8fece4e72292443dc71ff173593551203d011/src/b
- https://github.com/suitenumerique/docs/blob/dbf8fece4e72292443dc71ff173593551203d011/src/b
- https://github.com/suitenumerique/docs/pull/2838
This low severity vulnerability with a CVSS score of 2.3 was published on 2026-10-15 via NVD.
vulnfeed aggregates 14677 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.