CVE-2026-111169 Details
Description
La Suite Docs through 6.0.1 contains an authorization bypass vulnerability that allows authenticated users to write comments into threads of documents they cannot access. Attackers who know a thread UUID can route a POST comment request through their own document's resource_id, inserting comments into another document's thread without access.
A vulnerability allowing authorization bypass has been identified in La Suite Docs versions through 6.0.0. This issue enables authenticated users to post comments in document threads they do not have access to. Exploitation requires knowledge of the thread UUID, which can be used to send a comment request via the resource_id of a document the user does have access to.
Users can update to La Suite Docs version 6.0.1, which addresses this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| La Suite Docs | <= 6.0.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 26, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | CVE Modified | [email protected] |
| Oct 15, 2026 | New CVE Received | [email protected] |