CVE-2026-111169
LOW
CVSS 3.1
Published: 2026-10-15
Modified: 2026-10-16
Tenable Plugin
Checking the public Tenable catalog…
Threat Intelligence Pending
IOCs, MITRE ATT&CK techniques, and attack chain data are being generated. Refresh in a few seconds.
Description
La Suite Docs through 6.0.1 contains an authorization bypass vulnerability that allows authenticated users to write comments into threads of documents they cannot access. Attackers who know a thread UUID can route a POST comment request through their own document's resource_id, inserting comments into another document's thread without access.
Quick Facts
| CVE ID | CVE-2026-111169 |
| CVSS Score | 3.1 |
| Vector | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N |
| Published | 2026-10-15 |
| Exploited | No |
| CISA KEV | No |
| PoC | Not public |
References
- https://github.com/suitenumerique/docs
- https://github.com/suitenumerique/docs/blob/dbf8fece4e722924…
- https://github.com/suitenumerique/docs/blob/dbf8fece4e722924…
- https://github.com/suitenumerique/docs/blob/dbf8fece4e722924…
- https://github.com/suitenumerique/docs/commit/43f97482dfb968…
- https://github.com/suitenumerique/docs/pull/2838
- https://www.vulncheck.com/advisories/la-suite-docs-through-6…