CVE-2026-111169: Authorization Bypass Through User-Controlled Key in suitenumerique docs

Suite Docs versions up to and including 6.0.0 contain an authorization bypass vulnerability that permits authenticated users with limited privileges to write comments into threads of documents they cannot access. The flaw arises because the application does not properly validate the association between the thread UUID and the document resource_id in comment POST requests. Attackers who know a thread UUID can route their comment requests through their own document's resource_id, effectively inserting comments into another document's thread without authorization. This vulnerability has a CVSS 4.0 base score of 2.3, reflecting network attack vector, high complexity, low privileges required, no user interaction, and limited impact on confidentiality and integrity.

The vulnerability allows authenticated users to bypass authorization controls and insert comments into document threads they should not access. This could lead to unauthorized data manipulation or information disclosure through comment insertion. However, the impact is limited as it requires knowledge of thread UUIDs and authenticated access, and the CVSS score indicates low severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions to minimize exposure and monitor for suspicious comment activity related to unauthorized document threads.