suitenumerique Docs vulnerabilities

Latest suitenumerique Docs CVEs

Newest publication first

1. CVE-2026-111169 La Suite Docs through 6.0.1 Authorization Bypass via Comment Thread Creation

   Published 2026-10-15

   Low·CVSS 2.3 EPSS 0.27%

   La Suite Docs through 6.0.1 contains an authorization bypass vulnerability that allows authenticated users to write comments into threads of documents they cannot access. Attackers who know a thread UUID can route a POST comment request through their own document's resource_id, i...

2. CVE-2026-76907 LaSuite Doc: Public Documents Enumeration

   Published 2026-09-24

   Medium·CVSS 6.5 EPSS 0.25%

   LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 4.8.2 until 5.4.0, GET /api/v1.0/documents/search/ accepts sequential seven-digit document paths to scope descendant searches without requiring the caller to possess the public document UUID. An una...

3. CVE-2026-92800 Docs before 5.4.1 Stale Collaboration Session After Access Revocation

   Published 2026-09-16

   High·CVSS 7.6 EPSS 0.41%

   Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can retain real-time read and write access to sub-documents through open websocket sessions that are never disconnected.

4. CVE-2026-91081 Docs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpoint

   Published 2026-09-14

   Medium·CVSS 6.9 EPSS 0.51%

   Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID. Attackers can exploit DNS time-of-check-time-of-use race conditions and shared address...

5. CVE-2026-22867 LaSuite Doc affected by Stored XSS via Interlinking Block

   Published 2026-01-15

   Medium·CVSS 5.4 EPSS 0.30%

   LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 3.8.0 to 4.3.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Interlinking feature. When a user creates a link to another document within the editor, the URL of that link is not va...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.