Vulnerability · Published Sep 16, 2026 · Assigned by VulnCheck
CVE-2026-92800Docs before 5.4.1 Stale Collaboration Session After Access Revocation
Medium 6.8
In plain English
A medium-severity security flaw in Docs from suitenumerique. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Severity (CVSS 3.1)6.8Medium
Exploit odds (30 days)0.4%top 65.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can retain real-time read and write access to sub-documents through open websocket sessions that are never disconnected.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| suitenumerique | Docs | 0 – before 5.4.1 |
Weakness: CWE-613 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
References
- Researcher write-up technical-description, exploit
- reset collaboration connection in cascade for all children patch
- reset_connections is called with the access record's own document id technical-description
- https://github.com/suitenumerique/docs product
- VulnCheck Advisory: Docs before 5.4.1 Stale Collaboration Session After Access Revocation third-party-advisory