CVE-2026-92800

MEDIUM 6.8

Docs before 5.4.1 Stale Collaboration Session After Access Revocation

CVSS Score

6.8

EPSS Score

0.0%

EPSS Percentile

0th

Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can retain real-time read and write access to sub-documents through open websocket sessions that are never disconnected.

CWE	CWE-613
Vendor	suitenumerique
Product	docs
Published	Sep 16, 2026

Stay Ahead of the Next One

Get instant alerts for suitenumerique docs

Be the first to know when new medium vulnerabilities affecting suitenumerique docs are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

suitenumerique / Docs

0 < 5.4.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/geo-chen/oss/blob/main/docs.md github.com: https://github.com/suitenumerique/docs/commit/d35b81a6ed526dc284c8d0f68b762f2e81ffab13 github.com: https://github.com/suitenumerique/docs/blob/v5.3.0/src/backend/core/api/viewsets.py#L2825-L2860 github.com: https://github.com/suitenumerique/docs vulncheck.com: https://www.vulncheck.com/advisories/docs-before-5.4.1-stale-collaboration-session-after-access-revocation

Credits

George Chen