Low severity · published Oct 15, 2026
CVE-2026-111169
La Suite Docs through 6.0.1 Authorization Bypass via Comment Thread Creation
3.1
CVSS
0.3%
EPSS
No
On KEV
Description
La Suite Docs through 6.0.1 contains an authorization bypass vulnerability that allows authenticated users to write comments into threads of documents they cannot access. Attackers who know a thread UUID can route a POST comment request through their own document's resource_id, inserting comments into another document's thread without access.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
docs · suitenumerique
4.0.0 through 6.0.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-111169
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-111169
github.com
https://github.com/suitenumerique/docs
github.com
https://github.com/suitenumerique/docs/blob/dbf8fece4e72292443dc71ff173593551203d011/src/backend/core/api/permissions.py#L178-L182
github.com
https://github.com/suitenumerique/docs/blob/dbf8fece4e72292443dc71ff173593551203d011/src/backend/core/api/serializers.py#L929-L931
github.com
https://github.com/suitenumerique/docs/blob/dbf8fece4e72292443dc71ff173593551203d011/src/backend/core/api/viewsets.py#L3278-L3282
github.com
https://github.com/suitenumerique/docs/commit/43f97482dfb968264dceccabb76e155791c8e019
github.com
https://github.com/suitenumerique/docs/pull/2838
More from docs
6.8
CVE-2026-92800
Docs before 5.4.1 Stale Collaboration Session After Access Revocation
6.5
CVE-2026-76907
LaSuite Doc: Public Documents Enumeration
5.8
CVE-2026-91081
Docs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpoint
5.4
CVE-2026-22867
LaSuite Doc affected by Stored XSS via Interlinking Block