Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-111169 (GCVE-0-2026-111169)

Vulnerability from nvd – Published: 2026-10-15 18:57 – Updated: 2026-10-16 19:03

Title

La Suite Docs through 6.0.1 Authorization Bypass via Comment Thread Creation

Summary

La Suite Docs through 6.0.1 contains an authorization bypass vulnerability that allows authenticated users to write comments into threads of documents they cannot access. Attackers who know a thread UUID can route a POST comment request through their own document's resource_id, inserting comments into another document's thread without access.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6439 records in the last 180 days details

References

7 references

URL	Tags
https://github.com/suitenumerique/docs/pull/2838	patchissue-tracking
https://github.com/suitenumerique/docs/commit/43f…	patch
https://github.com/suitenumerique/docs/blob/dbf8f…	technical-description
https://github.com/suitenumerique/docs/blob/dbf8f…	technical-description
https://github.com/suitenumerique/docs/blob/dbf8f…	technical-description
https://github.com/suitenumerique/docs	product
https://www.vulncheck.com/advisories/la-suite-doc…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
suitenumerique	docs	Affected: 4.0.0 , ≤ 6.0.1 (semver)

Date Public

2026-10-14 00:00

Credits

Mansurzhan Mavlankulov

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/suitenumerique/docs",
          "product": "docs",
          "repo": "https://github.com/suitenumerique/docs",
          "vendor": "suitenumerique",
          "versions": [
            {
              "lessThanOrEqual": "6.0.1",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mansurzhan Mavlankulov"
        }
      ],
      "datePublic": "2026-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "La Suite Docs through 6.0.1 contains an authorization bypass vulnerability that allows authenticated users to write comments into threads of documents they cannot access. Attackers who know a thread UUID can route a POST comment request through their own document\u0027s resource_id, inserting comments into another document\u0027s thread without access."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T19:03:16.805Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "patch",
            "issue-tracking"
          ],
          "url": "https://github.com/suitenumerique/docs/pull/2838"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/suitenumerique/docs/commit/43f97482dfb968264dceccabb76e155791c8e019"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/suitenumerique/docs/blob/dbf8fece4e72292443dc71ff173593551203d011/src/backend/core/api/permissions.py#L178-L182"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/suitenumerique/docs/blob/dbf8fece4e72292443dc71ff173593551203d011/src/backend/core/api/viewsets.py#L3278-L3282"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/suitenumerique/docs/blob/dbf8fece4e72292443dc71ff173593551203d011/src/backend/core/api/serializers.py#L929-L931"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/suitenumerique/docs"
        },
        {
          "name": "VulnCheck Advisory: La Suite Docs through 6.0.0 Authorization Bypass via Comment Thread Creation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/la-suite-docs-through-6.0.0-authorization-bypass-via-comment-thread-creation"
        }
      ],
      "title": "La Suite Docs through 6.0.1 Authorization Bypass via Comment Thread Creation",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-111169",
    "datePublished": "2026-10-15T18:57:54.680Z",
    "dateReserved": "2026-10-15T17:04:06.571Z",
    "dateUpdated": "2026-10-16T19:03:16.805Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-76907 (GCVE-0-2026-76907)

Vulnerability from nvd – Published: 2026-09-24 15:44 – Updated: 2026-10-05 15:33

Title

LaSuite Doc: Public Documents Enumeration

Summary

LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 4.8.2 until 5.4.0, GET /api/v1.0/documents/search/ accepts sequential seven-digit document paths to scope descendant searches without requiring the caller to possess the public document UUID. An unauthenticated caller can submit an empty search query and iterate predictable path values to enumerate public document subtrees, obtaining document identifiers, titles, creator data, timestamps, and tree metadata. Each disclosed identifier can then be used through normal public-document endpoints to retrieve the document content, and differing 403 Forbidden and 404 Not Found responses reveal whether a guessed path exists. Authenticated users can similarly discover documents with authenticated link reach, while restricted documents remain protected. This issue is fixed in version 5.4.0.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-05 14:51 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7730 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/suitenumerique/docs/security/a…	x_refsource_CONFIRM
https://github.com/suitenumerique/docs/commit/9ef…	x_refsource_MISC
https://github.com/suitenumerique/docs/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
suitenumerique	docs	Affected: >= 4.8.2, < 5.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76907",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-05T14:51:06.072038Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-05T15:33:54.108Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "docs",
          "vendor": "suitenumerique",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.8.2, \u003c 5.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 4.8.2 until 5.4.0, GET /api/v1.0/documents/search/ accepts sequential seven-digit document paths to scope descendant searches without requiring the caller to possess the public document UUID. An unauthenticated caller can submit an empty search query and iterate predictable path values to enumerate public document subtrees, obtaining document identifiers, titles, creator data, timestamps, and tree metadata. Each disclosed identifier can then be used through normal public-document endpoints to retrieve the document content, and differing 403 Forbidden and 404 Not Found responses reveal whether a guessed path exists. Authenticated users can similarly discover documents with authenticated link reach, while restricted documents remain protected. This issue is fixed in version 5.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T15:44:45.292Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/suitenumerique/docs/security/advisories/GHSA-p8v2-wjj3-3j9w",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/suitenumerique/docs/security/advisories/GHSA-p8v2-wjj3-3j9w"
        },
        {
          "name": "https://github.com/suitenumerique/docs/commit/9ef4a15f5e7437c73ad04d2115a15dba3ffb7a76",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/suitenumerique/docs/commit/9ef4a15f5e7437c73ad04d2115a15dba3ffb7a76"
        },
        {
          "name": "https://github.com/suitenumerique/docs/releases/tag/v5.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/suitenumerique/docs/releases/tag/v5.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-p8v2-wjj3-3j9w",
        "discovery": "UNKNOWN"
      },
      "title": "LaSuite Doc: Public Documents Enumeration"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-76907",
    "datePublished": "2026-09-24T15:44:45.292Z",
    "dateReserved": "2026-08-19T22:43:14.891Z",
    "dateUpdated": "2026-10-05T15:33:54.108Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92800 (GCVE-0-2026-92800)

Vulnerability from nvd – Published: 2026-09-16 20:32 – Updated: 2026-09-19 01:48

Title

Docs before 5.4.1 Stale Collaboration Session After Access Revocation

Summary

Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can retain real-time read and write access to sub-documents through open websocket sessions that are never disconnected.

Severity

7.6 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-19 01:46 UTC

CWE

CWE-613 - Insufficient Session Expiration

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6439 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/geo-chen/oss/blob/main/docs.md	technical-descriptionexploit
https://github.com/suitenumerique/docs/commit/d35…	patch
https://github.com/suitenumerique/docs/blob/v5.3.…	technical-description
https://github.com/suitenumerique/docs	product
https://www.vulncheck.com/advisories/docs-before-…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
suitenumerique	Docs	Affected: 0 , < 5.4.1 (semver)

Date Public

2026-09-14 00:00

Credits

George Chen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92800",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-19T01:46:44.878763Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-19T01:48:05.151Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Docs",
          "vendor": "suitenumerique",
          "versions": [
            {
              "lessThan": "5.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-09-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can retain real-time read and write access to sub-documents through open websocket sessions that are never disconnected."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T20:32:51.118Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Researcher write-up",
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://github.com/geo-chen/oss/blob/main/docs.md"
        },
        {
          "name": "reset collaboration connection in cascade for all children",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/suitenumerique/docs/commit/d35b81a6ed526dc284c8d0f68b762f2e81ffab13"
        },
        {
          "name": "reset_connections is called with the access record\u0027s own document id",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/suitenumerique/docs/blob/v5.3.0/src/backend/core/api/viewsets.py#L2825-L2860"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/suitenumerique/docs"
        },
        {
          "name": "VulnCheck Advisory: Docs before 5.4.1 Stale Collaboration Session After Access Revocation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/docs-before-5.4.1-stale-collaboration-session-after-access-revocation"
        }
      ],
      "title": "Docs before 5.4.1 Stale Collaboration Session After Access Revocation",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-92800",
    "datePublished": "2026-09-16T20:32:51.118Z",
    "dateReserved": "2026-09-16T19:47:13.148Z",
    "dateUpdated": "2026-09-19T01:48:05.151Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-91081 (GCVE-0-2026-91081)

Vulnerability from nvd – Published: 2026-09-14 17:52 – Updated: 2026-09-24 14:22

Title

Docs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpoint

Summary

Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID. Attackers can exploit DNS time-of-check-time-of-use race conditions and shared address space bypasses to access internal network resources and exfiltrate image content.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

5.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-20 00:13 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6439 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/suitenumerique/docs/issues/2545	issue-tracking
https://github.com/suitenumerique/docs	product
https://github.com/suitenumerique/docs/blob/v5.6.…	technical-description
https://github.com/suitenumerique/docs/blob/v5.6.…	technical-description
https://www.vulncheck.com/advisories/docs-through…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
suitenumerique	docs	Affected: 0 , ≤ 5.6.1 (semver)

Date Public

2026-07-29 00:00

Credits

George Chen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91081",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-20T00:13:42.673520Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-20T00:35:30.845Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "docs",
          "repo": "https://github.com/suitenumerique/docs",
          "vendor": "suitenumerique",
          "versions": [
            {
              "lessThanOrEqual": "5.6.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-07-29T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID. Attackers can exploit DNS time-of-check-time-of-use race conditions and shared address space bypasses to access internal network resources and exfiltrate image content."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T14:22:09.421Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #2545",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/suitenumerique/docs/issues/2545"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/suitenumerique/docs"
        },
        {
          "name": "core/api/viewsets.py at v5.6.1",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/suitenumerique/docs/blob/v5.6.1/src/backend/core/api/viewsets.py"
        },
        {
          "name": "core/models.py at v5.6.1",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/suitenumerique/docs/blob/v5.6.1/src/backend/core/models.py"
        },
        {
          "name": "VulnCheck Advisory: Docs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpoint",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/docs-through-5.6.1-ssrf-via-unauthenticated-cors-proxy-endpoint"
        }
      ],
      "title": "Docs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpoint",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-91081",
    "datePublished": "2026-09-14T17:52:08.910Z",
    "dateReserved": "2026-09-14T17:33:17.464Z",
    "dateUpdated": "2026-09-24T14:22:09.421Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-22867 (GCVE-0-2026-22867)

Vulnerability from nvd – Published: 2026-01-15 16:31 – Updated: 2026-01-15 16:46

Title

LaSuite Doc affected by Stored XSS via Interlinking Block

Summary

LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 3.8.0 to 4.3.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Interlinking feature. When a user creates a link to another document within the editor, the URL of that link is not validated. An attacker with document editing privileges can inject a malicious javascript: URL that executes arbitrary code when other users click on the link. This vulnerability is fixed in 4.4.0.

Severity

8.7 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-15 16:46 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7730 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/suitenumerique/docs/security/a…	x_refsource_CONFIRM
https://github.com/suitenumerique/docs/commit/e80…	x_refsource_MISC
https://github.com/suitenumerique/docs/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
suitenumerique	docs	Affected: >= 3.8.0, < 4.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-22867",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-15T16:46:46.550304Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-15T16:46:57.161Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "docs",
          "vendor": "suitenumerique",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.8.0, \u003c 4.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 3.8.0 to 4.3.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Interlinking feature. When a user creates a link to another document within the editor, the URL of that link is not validated. An attacker with document editing privileges can inject a malicious javascript: URL that executes arbitrary code when other users click on the link. This vulnerability is fixed in 4.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-15T16:31:34.397Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/suitenumerique/docs/security/advisories/GHSA-4rwv-ghwh-9rv6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/suitenumerique/docs/security/advisories/GHSA-4rwv-ghwh-9rv6"
        },
        {
          "name": "https://github.com/suitenumerique/docs/commit/e807237dbedbc189230296b81c3aeccc1c04fa77",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/suitenumerique/docs/commit/e807237dbedbc189230296b81c3aeccc1c04fa77"
        },
        {
          "name": "https://github.com/suitenumerique/docs/releases/tag/v4.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/suitenumerique/docs/releases/tag/v4.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-4rwv-ghwh-9rv6",
        "discovery": "UNKNOWN"
      },
      "title": "LaSuite Doc affected by Stored XSS via Interlinking Block"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-22867",
    "datePublished": "2026-01-15T16:31:34.397Z",
    "dateReserved": "2026-01-12T16:20:16.746Z",
    "dateUpdated": "2026-01-15T16:46:57.161Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-111169 (GCVE-0-2026-111169)

Vulnerability from cvelistv5 – Published: 2026-10-15 18:57 – Updated: 2026-10-16 19:03

Title

La Suite Docs through 6.0.1 Authorization Bypass via Comment Thread Creation

Summary

La Suite Docs through 6.0.1 contains an authorization bypass vulnerability that allows authenticated users to write comments into threads of documents they cannot access. Attackers who know a thread UUID can route a POST comment request through their own document's resource_id, inserting comments into another document's thread without access.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6439 records in the last 180 days details

References

7 references

URL	Tags
https://github.com/suitenumerique/docs/pull/2838	patchissue-tracking
https://github.com/suitenumerique/docs/commit/43f…	patch
https://github.com/suitenumerique/docs/blob/dbf8f…	technical-description
https://github.com/suitenumerique/docs/blob/dbf8f…	technical-description
https://github.com/suitenumerique/docs/blob/dbf8f…	technical-description
https://github.com/suitenumerique/docs	product
https://www.vulncheck.com/advisories/la-suite-doc…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
suitenumerique	docs	Affected: 4.0.0 , ≤ 6.0.1 (semver)

Date Public

2026-10-14 00:00

Credits

Mansurzhan Mavlankulov

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/suitenumerique/docs",
          "product": "docs",
          "repo": "https://github.com/suitenumerique/docs",
          "vendor": "suitenumerique",
          "versions": [
            {
              "lessThanOrEqual": "6.0.1",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mansurzhan Mavlankulov"
        }
      ],
      "datePublic": "2026-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "La Suite Docs through 6.0.1 contains an authorization bypass vulnerability that allows authenticated users to write comments into threads of documents they cannot access. Attackers who know a thread UUID can route a POST comment request through their own document\u0027s resource_id, inserting comments into another document\u0027s thread without access."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T19:03:16.805Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "patch",
            "issue-tracking"
          ],
          "url": "https://github.com/suitenumerique/docs/pull/2838"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/suitenumerique/docs/commit/43f97482dfb968264dceccabb76e155791c8e019"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/suitenumerique/docs/blob/dbf8fece4e72292443dc71ff173593551203d011/src/backend/core/api/permissions.py#L178-L182"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/suitenumerique/docs/blob/dbf8fece4e72292443dc71ff173593551203d011/src/backend/core/api/viewsets.py#L3278-L3282"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/suitenumerique/docs/blob/dbf8fece4e72292443dc71ff173593551203d011/src/backend/core/api/serializers.py#L929-L931"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/suitenumerique/docs"
        },
        {
          "name": "VulnCheck Advisory: La Suite Docs through 6.0.0 Authorization Bypass via Comment Thread Creation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/la-suite-docs-through-6.0.0-authorization-bypass-via-comment-thread-creation"
        }
      ],
      "title": "La Suite Docs through 6.0.1 Authorization Bypass via Comment Thread Creation",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-111169",
    "datePublished": "2026-10-15T18:57:54.680Z",
    "dateReserved": "2026-10-15T17:04:06.571Z",
    "dateUpdated": "2026-10-16T19:03:16.805Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-76907 (GCVE-0-2026-76907)

Vulnerability from cvelistv5 – Published: 2026-09-24 15:44 – Updated: 2026-10-05 15:33

Title

LaSuite Doc: Public Documents Enumeration

Summary

LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 4.8.2 until 5.4.0, GET /api/v1.0/documents/search/ accepts sequential seven-digit document paths to scope descendant searches without requiring the caller to possess the public document UUID. An unauthenticated caller can submit an empty search query and iterate predictable path values to enumerate public document subtrees, obtaining document identifiers, titles, creator data, timestamps, and tree metadata. Each disclosed identifier can then be used through normal public-document endpoints to retrieve the document content, and differing 403 Forbidden and 404 Not Found responses reveal whether a guessed path exists. Authenticated users can similarly discover documents with authenticated link reach, while restricted documents remain protected. This issue is fixed in version 5.4.0.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-05 14:51 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7730 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/suitenumerique/docs/security/a…	x_refsource_CONFIRM
https://github.com/suitenumerique/docs/commit/9ef…	x_refsource_MISC
https://github.com/suitenumerique/docs/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
suitenumerique	docs	Affected: >= 4.8.2, < 5.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76907",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-05T14:51:06.072038Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-05T15:33:54.108Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "docs",
          "vendor": "suitenumerique",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.8.2, \u003c 5.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 4.8.2 until 5.4.0, GET /api/v1.0/documents/search/ accepts sequential seven-digit document paths to scope descendant searches without requiring the caller to possess the public document UUID. An unauthenticated caller can submit an empty search query and iterate predictable path values to enumerate public document subtrees, obtaining document identifiers, titles, creator data, timestamps, and tree metadata. Each disclosed identifier can then be used through normal public-document endpoints to retrieve the document content, and differing 403 Forbidden and 404 Not Found responses reveal whether a guessed path exists. Authenticated users can similarly discover documents with authenticated link reach, while restricted documents remain protected. This issue is fixed in version 5.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T15:44:45.292Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/suitenumerique/docs/security/advisories/GHSA-p8v2-wjj3-3j9w",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/suitenumerique/docs/security/advisories/GHSA-p8v2-wjj3-3j9w"
        },
        {
          "name": "https://github.com/suitenumerique/docs/commit/9ef4a15f5e7437c73ad04d2115a15dba3ffb7a76",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/suitenumerique/docs/commit/9ef4a15f5e7437c73ad04d2115a15dba3ffb7a76"
        },
        {
          "name": "https://github.com/suitenumerique/docs/releases/tag/v5.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/suitenumerique/docs/releases/tag/v5.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-p8v2-wjj3-3j9w",
        "discovery": "UNKNOWN"
      },
      "title": "LaSuite Doc: Public Documents Enumeration"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-76907",
    "datePublished": "2026-09-24T15:44:45.292Z",
    "dateReserved": "2026-08-19T22:43:14.891Z",
    "dateUpdated": "2026-10-05T15:33:54.108Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92800 (GCVE-0-2026-92800)

Vulnerability from cvelistv5 – Published: 2026-09-16 20:32 – Updated: 2026-09-19 01:48

Title

Docs before 5.4.1 Stale Collaboration Session After Access Revocation

Summary

Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can retain real-time read and write access to sub-documents through open websocket sessions that are never disconnected.

Severity

7.6 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-19 01:46 UTC

CWE

CWE-613 - Insufficient Session Expiration

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6439 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/geo-chen/oss/blob/main/docs.md	technical-descriptionexploit
https://github.com/suitenumerique/docs/commit/d35…	patch
https://github.com/suitenumerique/docs/blob/v5.3.…	technical-description
https://github.com/suitenumerique/docs	product
https://www.vulncheck.com/advisories/docs-before-…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
suitenumerique	Docs	Affected: 0 , < 5.4.1 (semver)

Date Public

2026-09-14 00:00

Credits

George Chen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92800",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-19T01:46:44.878763Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-19T01:48:05.151Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Docs",
          "vendor": "suitenumerique",
          "versions": [
            {
              "lessThan": "5.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-09-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can retain real-time read and write access to sub-documents through open websocket sessions that are never disconnected."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T20:32:51.118Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Researcher write-up",
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://github.com/geo-chen/oss/blob/main/docs.md"
        },
        {
          "name": "reset collaboration connection in cascade for all children",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/suitenumerique/docs/commit/d35b81a6ed526dc284c8d0f68b762f2e81ffab13"
        },
        {
          "name": "reset_connections is called with the access record\u0027s own document id",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/suitenumerique/docs/blob/v5.3.0/src/backend/core/api/viewsets.py#L2825-L2860"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/suitenumerique/docs"
        },
        {
          "name": "VulnCheck Advisory: Docs before 5.4.1 Stale Collaboration Session After Access Revocation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/docs-before-5.4.1-stale-collaboration-session-after-access-revocation"
        }
      ],
      "title": "Docs before 5.4.1 Stale Collaboration Session After Access Revocation",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-92800",
    "datePublished": "2026-09-16T20:32:51.118Z",
    "dateReserved": "2026-09-16T19:47:13.148Z",
    "dateUpdated": "2026-09-19T01:48:05.151Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-91081 (GCVE-0-2026-91081)

Vulnerability from cvelistv5 – Published: 2026-09-14 17:52 – Updated: 2026-09-24 14:22

Title

Docs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpoint

Summary

Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID. Attackers can exploit DNS time-of-check-time-of-use race conditions and shared address space bypasses to access internal network resources and exfiltrate image content.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

5.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-20 00:13 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6439 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/suitenumerique/docs/issues/2545	issue-tracking
https://github.com/suitenumerique/docs	product
https://github.com/suitenumerique/docs/blob/v5.6.…	technical-description
https://github.com/suitenumerique/docs/blob/v5.6.…	technical-description
https://www.vulncheck.com/advisories/docs-through…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
suitenumerique	docs	Affected: 0 , ≤ 5.6.1 (semver)

Date Public

2026-07-29 00:00

Credits

George Chen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91081",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-20T00:13:42.673520Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-20T00:35:30.845Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "docs",
          "repo": "https://github.com/suitenumerique/docs",
          "vendor": "suitenumerique",
          "versions": [
            {
              "lessThanOrEqual": "5.6.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-07-29T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID. Attackers can exploit DNS time-of-check-time-of-use race conditions and shared address space bypasses to access internal network resources and exfiltrate image content."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T14:22:09.421Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #2545",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/suitenumerique/docs/issues/2545"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/suitenumerique/docs"
        },
        {
          "name": "core/api/viewsets.py at v5.6.1",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/suitenumerique/docs/blob/v5.6.1/src/backend/core/api/viewsets.py"
        },
        {
          "name": "core/models.py at v5.6.1",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/suitenumerique/docs/blob/v5.6.1/src/backend/core/models.py"
        },
        {
          "name": "VulnCheck Advisory: Docs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpoint",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/docs-through-5.6.1-ssrf-via-unauthenticated-cors-proxy-endpoint"
        }
      ],
      "title": "Docs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpoint",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-91081",
    "datePublished": "2026-09-14T17:52:08.910Z",
    "dateReserved": "2026-09-14T17:33:17.464Z",
    "dateUpdated": "2026-09-24T14:22:09.421Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-22867 (GCVE-0-2026-22867)

Vulnerability from cvelistv5 – Published: 2026-01-15 16:31 – Updated: 2026-01-15 16:46

Title

LaSuite Doc affected by Stored XSS via Interlinking Block

Summary

LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 3.8.0 to 4.3.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Interlinking feature. When a user creates a link to another document within the editor, the URL of that link is not validated. An attacker with document editing privileges can inject a malicious javascript: URL that executes arbitrary code when other users click on the link. This vulnerability is fixed in 4.4.0.

Severity

8.7 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-15 16:46 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7730 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/suitenumerique/docs/security/a…	x_refsource_CONFIRM
https://github.com/suitenumerique/docs/commit/e80…	x_refsource_MISC
https://github.com/suitenumerique/docs/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
suitenumerique	docs	Affected: >= 3.8.0, < 4.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-22867",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-15T16:46:46.550304Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-15T16:46:57.161Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "docs",
          "vendor": "suitenumerique",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.8.0, \u003c 4.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 3.8.0 to 4.3.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Interlinking feature. When a user creates a link to another document within the editor, the URL of that link is not validated. An attacker with document editing privileges can inject a malicious javascript: URL that executes arbitrary code when other users click on the link. This vulnerability is fixed in 4.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-15T16:31:34.397Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/suitenumerique/docs/security/advisories/GHSA-4rwv-ghwh-9rv6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/suitenumerique/docs/security/advisories/GHSA-4rwv-ghwh-9rv6"
        },
        {
          "name": "https://github.com/suitenumerique/docs/commit/e807237dbedbc189230296b81c3aeccc1c04fa77",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/suitenumerique/docs/commit/e807237dbedbc189230296b81c3aeccc1c04fa77"
        },
        {
          "name": "https://github.com/suitenumerique/docs/releases/tag/v4.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/suitenumerique/docs/releases/tag/v4.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-4rwv-ghwh-9rv6",
        "discovery": "UNKNOWN"
      },
      "title": "LaSuite Doc affected by Stored XSS via Interlinking Block"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-22867",
    "datePublished": "2026-01-15T16:31:34.397Z",
    "dateReserved": "2026-01-12T16:20:16.746Z",
    "dateUpdated": "2026-01-15T16:46:57.161Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

10 vulnerabilities found for docs by suitenumerique

CVE-2026-111169 (GCVE-0-2026-111169)

CVE-2026-76907 (GCVE-0-2026-76907)

CVE-2026-92800 (GCVE-0-2026-92800)

CVE-2026-91081 (GCVE-0-2026-91081)

CVE-2026-22867 (GCVE-0-2026-22867)

CVE-2026-111169 (GCVE-0-2026-111169)

CVE-2026-76907 (GCVE-0-2026-76907)

CVE-2026-92800 (GCVE-0-2026-92800)

CVE-2026-91081 (GCVE-0-2026-91081)

CVE-2026-22867 (GCVE-0-2026-22867)