CVE-2026-91081 Details
Description
Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID. Attackers can exploit DNS time-of-check-time-of-use race conditions and shared address space bypasses to access internal network resources and exfiltrate image content.
A server-side request forgery (SSRF) vulnerability has been identified in La Suite Docs versions through 5.6.1. The issue resides in the CORS proxy endpoint, which allows anonymous attackers to make outbound requests by providing a public document UUID. Exploitation of this vulnerability is possible due to DNS time-of-check-time-of-use race conditions and shared address space bypasses, enabling access to internal network resources and exfiltration of image content.
It is recommended to require authentication for the CORS proxy endpoint, regardless of the document's link reach. This can be done by adding an 'IsAuthenticated' check to the permission classes or by validating the user's authentication status within the handler before performing the URL validation against SSRF risks.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 14, 2026CISA-ADP
Assessed Sep 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/suitenumerique/docs | [email protected] | Vendor |
| https://github.com/suitenumerique/docs/blob/v5.6.1/src/backend/core/api/viewsets.py | [email protected] | Source CodeVendor |
| https://github.com/suitenumerique/docs/blob/v5.6.1/src/backend/core/models.py | [email protected] | Source CodeVendor |
| https://github.com/suitenumerique/docs/issues/2545 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/docs-through-5.6.1-ssrf-via-unauthenticated-cors-proxy-endpoint | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Suitenumerique Docs | <= 5.6.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 20, 2026 | CVE Modified | CISA-ADP |
| Sep 14, 2026 | New CVE Received | [email protected] |