Threat database

Suite Docs versions 4.0.0 through 6.0.1 contain an authorization bypass vulnerability that permits authenticated users to write comments into document threads they do not have access to. This occurs when an attacker, knowing a thread UUID, routes a POST comment request through their own document's resource_id, enabling insertion of comments into another document's thread without proper authorization. The vulnerability has a low severity with a CVSS 4.0 base score of 2.3.

CVE-2026-76907 is an information exposure vulnerability in the suitenumerique docs platform versions 4.8.2 through before 5.4.0. It allows unauthenticated users to enumerate document identifiers, titles, creator data, timestamps, and metadata by exploiting predictable document path values in the search API. Authenticated users can also discover documents accessible via authenticated links, though restricted documents remain protected. The issue is fixed in version 5.4.0.

Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can retain real-time read and write access to sub-documents through open websocket sessions that are never disconnected.

Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID. Attackers can exploit DNS time-of-check-time-of-use race conditions and shared address space bypasses to access internal network resources and exfiltrate image content.

People is an application to handle users and teams, and distribute permissions across La Suite. Prior to version 1.25.0, a user holding the Administrator role on a mail domain could send a crafted invitation request to promote any existing user (including users with no current domain access) to the Owner role. The exploit requires a single authenticated HTTP request and grants full domain ownership immediately, without any acceptance step from the target. This issue has been patched in version 1.25.0.

A security flaw has been discovered in suitenumerique messages 0.2.0. This issue affects the function ThreadAccessSerializer of the file src/backend/core/api/serializers.py of the component ThreadAccess. The manipulation results in improper authentication. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.3.0 is capable of addressing this issue. The patch is identified as d7729f4b885449f6dee3faf8b5f2a05769fb3d6e. The affected component should be upgraded.

LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 3.8.0 to 4.3.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Interlinking feature. When a user creates a link to another document within the editor, the URL of that link is not validated. An attacker with document editing privileges can inject a malicious javascript: URL that executes arbitrary code when other users click on the link. This vulnerability is fixed in 4.4.0.