The linqi application suffers from an authorization bypass vulnerability (CWE-639) in its Comment API. Specifically, the GET and POST methods for /api/Comment fail to perform proper authorization checks on the relatedObjectId parameter. As a result, authenticated users can access or modify comments on any process by providing arbitrary object GUIDs, bypassing intended access controls. This vulnerability is categorized as an IDOR and has a CVSS 4.0 base score of 7.1, indicating a high impact due to network attack vector, low attack complexity, and no user interaction required.

An attacker with valid authentication credentials can read and write comments on any process across all business units, potentially exposing or altering sensitive information. This compromises the integrity and confidentiality of comment data within the application. There is no indication of privilege escalation beyond comment access or impact on other system components based on the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided by the vendor, organizations should monitor vendor communications for updates. Until a fix is available, consider restricting access to the Comment API endpoints to trusted users only and implementing additional access control checks at the application or network level if possible.