Authorization bypass in La Suite Docs lets users comment on other threads
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
La Suite Docs through 6.0.1 contains an authorization bypass that lets authenticated users write comments into threads of documents they cannot access. An attacker who knows a thread UUID can route a comment request through their own document's resource_id, inserting comments into another document's thread. The attack is complex and requires low privileges, with no user interaction needed. The flaw is tracked as CWE-639.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
La Suite Docs through 6.0.1 contains an authorization bypass vulnerability that allows authenticated users to write comments into threads of documents they cannot access. Attackers who know a thread UUID can route a POST comment request through their own document's resource_id, inserting comments into another document's thread without access.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| suitenumerique | docs | 4.0.0 – 6.0.1 | — | No fix listed | CNA |
- docs Vendorsuitenumerique Affected 4.0.0 – 6.0.1 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for La Suite Docs.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-16 Threatist record created from CVE-2026-111169
- 2026-10-18 Title updated · CNA
- 2026-10-18 Affected versions changed · CNA
- 2026-10-18 1 new reference · CNA
- 2026-10-18 Alias added: GHSA-pxmx-2p3q-jfwf
- 2026-10-26 CISA SSVC decision points changed
References
Patch 2
Other 4
- https://github.com/suitenumerique/docs/blob/dbf8fece4e72292443dc71ff173593551203d011/src/backend/core/api/permissions.py#L178-L182
- https://github.com/suitenumerique/docs/blob/dbf8fece4e72292443dc71ff173593551203d011/src/backend/core/api/viewsets.py#L3278-L3282
- https://github.com/suitenumerique/docs/blob/dbf8fece4e72292443dc71ff173593551203d011/src/backend/core/api/serializers.py#L929-L931
- https://github.com/suitenumerique/docs
More suitenumerique vulnerabilities
- TI-2026-62539 Docs before 5.4.1 Stale Collaboration Session After Access Revocation CVSS 4.0HIGH 7.6
- TI-2026-30507 People: Privilege Escalation via Missing Role Ceiling in Mail Domain Invitation CVSS 3.1MEDIUM 5.5
- TI-2026-03229 suitenumerique messages ThreadAccess serializers.py ThreadAccessSerializer improper authentication CVSS 4.0MEDIUM 5.3
- TI-2026-61870 Docs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpoint CVSS 4.0MEDIUM 6.9
- TI-2026-53731 LaSuite Doc: Public Documents Enumeration CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-111169 · CVE Program
- CVE-2026-111169 · NVD
- FIRST EPSS
- GHSA-pxmx-2p3q-jfwf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences