CVE-2026-76907 Details
Description
LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 4.8.2 until 5.4.0, GET /api/v1.0/documents/search/ accepts sequential seven-digit document paths to scope descendant searches without requiring the caller to possess the public document UUID. An unauthenticated caller can submit an empty search query and iterate predictable path values to enumerate public document subtrees, obtaining document identifiers, titles, creator data, timestamps, and tree metadata. Each disclosed identifier can then be used through normal public-document endpoints to retrieve the document content, and differing 403 Forbidden and 404 Not Found responses reveal whether a guessed path exists. Authenticated users can similarly discover documents with authenticated link reach, while restricted documents remain protected. This issue is fixed in version 5.4.0.
A vulnerability in LaSuite Doc versions 4.8.2 prior to 5.4.0 allows unauthenticated users to enumerate public documents through the search API. The vulnerability arises because the API accepts sequential seven-digit document paths, which can be guessed to access document subtrees without needing the document's UUID. This flaw enables the discovery of document identifiers, titles, creator information, timestamps, and metadata. Each identifier can then be used to retrieve the full document content via public endpoints. The issue is caused by the search endpoint's failure to verify if a caller is entitled to access a document, only checking its public status. The vulnerability is patched in version 5.4.0.
Users can update to LaSuite Doc version 5.4.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/suitenumerique/docs/commit/9ef4a15f5e7437c73ad04d2115a15dba3ffb7a76 | [email protected] | Source CodeVendor |
| https://github.com/suitenumerique/docs/releases/tag/v5.4.0 | [email protected] | Release NotesVendor |
| https://github.com/suitenumerique/docs/security/advisories/GHSA-p8v2-wjj3-3j9w | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| LaSuite Doc | >= 4.8.2, < 5.4.0 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | New CVE Received | [email protected] |