{"id":"CVE-2026-111169","revision":"75bd862ce6624cea80d320fd8b4558c9","records":[{"revision":"75bd862ce6624cea80d320fd8b4558c9","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-111169","aliases":[],"title":"La Suite Docs through 6.0.1 Authorization Bypass via Comment Thread Creation","description":"La Suite Docs through 6.0.1 contains an authorization bypass vulnerability that allows authenticated users to write comments into threads of documents they cannot access. Attackers who know a thread UUID can route a POST comment request through their own document's resource_id, inserting comments into another document's thread without access.","state":0,"publishedAt":"2026-10-15T18:57:54.68+00:00","modifiedAt":"2026-10-16T19:03:16.805+00:00","affected":[{"ecosystem":"Vendor product","name":"docs","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"suitenumerique\",\n                    \"product\": \"docs\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"4.0.0\",\n                            \"lessThanOrEqual\": \"6.0.1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"packageURL\": \"pkg:github/suitenumerique/docs\",\n                    \"repo\": \"https://github.com/suitenumerique/docs\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","score":2.3,"severity":"LOW"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","score":3.1,"severity":"LOW"}],"references":["https://github.com/suitenumerique/docs/pull/2838","https://github.com/suitenumerique/docs/commit/43f97482dfb968264dceccabb76e155791c8e019","https://github.com/suitenumerique/docs/blob/dbf8fece4e72292443dc71ff173593551203d011/src/backend/core/api/permissions.py#L178-L182","https://github.com/suitenumerique/docs/blob/dbf8fece4e72292443dc71ff173593551203d011/src/backend/core/api/viewsets.py#L3278-L3282","https://github.com/suitenumerique/docs/blob/dbf8fece4e72292443dc71ff173593551203d011/src/backend/core/api/serializers.py#L929-L931","https://github.com/suitenumerique/docs","https://www.vulncheck.com/advisories/la-suite-docs-through-6.0.0-authorization-bypass-via-comment-thread-creation"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111169","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-111169","identifiers":["CVE-2026-111169"]},"retained":false,"historicalAffected":[]}],"coverage":[]}