In suitenumerique docs versions >=4.8.2 and <5.4.0, the GET /api/v1.0/documents/search/ endpoint accepts sequential seven-digit document paths to scope descendant searches without requiring possession of the public document UUID. An unauthenticated attacker can submit empty search queries and iterate predictable path values to enumerate public document subtrees, exposing document identifiers, titles, creator information, timestamps, and tree metadata. These identifiers can then be used to retrieve document content via public-document endpoints. The difference in HTTP responses (403 Forbidden vs 404 Not Found) reveals whether a guessed path exists. Authenticated users can also discover documents accessible through authenticated links, but documents with restricted access remain protected. The vulnerability is resolved in version 5.4.0.

This vulnerability allows unauthorized actors to enumerate and access metadata and content of public documents without authentication. It exposes sensitive information such as document identifiers, titles, creator data, timestamps, and document content. However, restricted documents remain protected and are not disclosed. The CVSS score of 6.5 reflects a medium severity impact with confidentiality and integrity impacts but no availability impact.

This issue is fixed in suitenumerique docs version 5.4.0. Users should upgrade to version 5.4.0 or later to remediate this vulnerability. No additional mitigation actions are indicated by the vendor advisory.