CVE-2026-111169
La Suite Docs through 6.0.1 Authorization Bypass via Comment Thread Creation
suitenumerique docs
CVSS
2.3LowExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.27%Chance of exploitation activity in the next 30 days, higher than 18% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
La Suite Docs through 6.0.1 contains an authorization bypass vulnerability that allows authenticated users to write comments into threads of documents they cannot access. Attackers who know a thread UUID can route a POST comment request through their own document's resource_id, inserting comments into another document's thread without access.
Text from CVE List
Affected versions 1
- docsaffected: 4.0.0 through 6.0.1CVE List
References 7
- github.com/suitenumerique/docs/pull/2838Fixvia CVE List
- github.com/suitenumerique/docs/commit/43f97482dfb968264dceccabb76e155791c8e019Fixvia CVE List
- vulncheck.com/advisories/la-suite-docs-through-6.0.0-authorization-bypass-via-comment-thread-creationAdvisoryvia CVE List
- github.com/suitenumerique/docs/blob/dbf8fece4e72292443dc71ff173593551203d011/src/backend/core/api/permissions.py#L178-L182Referencevia CVE List
- github.com/suitenumerique/docs/blob/dbf8fece4e72292443dc71ff173593551203d011/src/backend/core/api/viewsets.py#L3278-L3282Referencevia CVE List
- github.com/suitenumerique/docs/blob/dbf8fece4e72292443dc71ff173593551203d011/src/backend/core/api/serializers.py#L929-L931Referencevia CVE List
- github.com/suitenumerique/docsReferencevia CVE List