Threats tagged 'ghsa-pxmx-2p3q-jfwf'

Suite Docs versions 4.0.0 through 6.0.1 contain an authorization bypass vulnerability that permits authenticated users to write comments into document threads they do not have access to. This occurs when an attacker, knowing a thread UUID, routes a POST comment request through their own document's resource_id, enabling insertion of comments into another document's thread without proper authorization. The vulnerability has a low severity with a CVSS 4.0 base score of 2.3.