CVE-2026-111169
La Suite Docs through 6.0.0 Authorization Bypass via Comment Thread Creation
CVSS Score
3.1
EPSS Score
0.0%
EPSS Percentile
0th
La Suite Docs through 6.0.0 contains an authorization bypass vulnerability that allows authenticated users to write comments into threads of documents they cannot access. Attackers who know a thread UUID can route a POST comment request through their own document's resource_id, inserting comments into another document's thread without access.
| CWE | CWE-639 |
| Vendor | suitenumerique |
| Product | docs |
| Published | Oct 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for suitenumerique docs
Be the first to know when new low vulnerabilities affecting suitenumerique docs are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Affected Versions
suitenumerique / docs
0 ≤ 6.0.0
References
github.com: https://github.com/suitenumerique/docs/pull/2838 github.com: https://github.com/suitenumerique/docs/blob/dbf8fece4e72292443dc71ff173593551203d011/src/backend/core/api/permissions.py#L178-L182 github.com: https://github.com/suitenumerique/docs/blob/dbf8fece4e72292443dc71ff173593551203d011/src/backend/core/api/viewsets.py#L3278-L3282 github.com: https://github.com/suitenumerique/docs/blob/dbf8fece4e72292443dc71ff173593551203d011/src/backend/core/api/serializers.py#L929-L931 github.com: https://github.com/suitenumerique/docs vulncheck.com: https://www.vulncheck.com/advisories/la-suite-docs-through-6.0.0-authorization-bypass-via-comment-thread-creation
Credits
Mansurzhan Mavlankulov