Vulnerability · Published Oct 15, 2026 · Assigned by VulnCheck

CVE-2026-111169La Suite Docs through 6.0.1 Authorization Bypass via Comment Thread Creation

Low 3.1

In plain English

A low-severity authorization bypass via user-controlled key in docs from suitenumerique. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)3.1Low

Exploit odds (30 days)0.3%top 79.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

La Suite Docs through 6.0.1 contains an authorization bypass vulnerability that allows authenticated users to write comments into threads of documents they cannot access. Attackers who know a thread UUID can route a POST comment request through their own document's resource_id, inserting comments into another document's thread without access.

Affected products (as reported)

Vendor	Product	Versions
suitenumerique	docs	4.0.0 – through 6.0.1

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

References

https://github.com/suitenumerique/docs/pull/2838 patch, issue-tracking
https://github.com/suitenumerique/docs/commit/43f97482dfb968264dceccabb76e155791c8e019 patch
https://github.com/suitenumerique/docs/blob/dbf8fece4e72292443dc71ff173593551203d011/src/backend/core/api/permissions.py#L178-L182 technical-description
https://github.com/suitenumerique/docs/blob/dbf8fece4e72292443dc71ff173593551203d011/src/backend/core/api/viewsets.py#L3278-L3282 technical-description
https://github.com/suitenumerique/docs/blob/dbf8fece4e72292443dc71ff173593551203d011/src/backend/core/api/serializers.py#L929-L931 technical-description
https://github.com/suitenumerique/docs product
VulnCheck Advisory: La Suite Docs through 6.0.0 Authorization Bypass via Comment Thread Creation third-party-advisory