Vulnerabilidades de Suitenumerique
CVEs publicadas que afetam produtos de Suitenumerique: 4 registro(s), com severidade, exploração e correções.
CVE-2026-111169
Baixa · 3.1
CWE-639 15/10/2026
La Suite Docs through 6.0.0 Authorization Bypass via Comment Thread Creation
La Suite Docs through 6.0.0 contains an authorization bypass vulnerability that allows authenticated users to write comments into threads of documents they cannot access. Attackers who know a thread UUID can route a POST comment request through their own document's resource_id, inserting comments into another document's thread without access.
CVE-2026-42185
Média · 5.5
CWE-269 08/05/2026
People: Privilege Escalation via Missing Role Ceiling in Mail Domain Invitation
People is an application to handle users and teams, and distribute permissions across La Suite. Prior to version 1.25.0, a user holding the Administrator role on a mail domain could send a crafted invitation request to promote any existing user (including users with no current domain access) to the Owner role. The exploit requires a single authenticated HTTP request and grants full domain ownership immediately, without any acceptance step from the target. This issue has been patched in version 1.25.0.
CVE-2026-3739
Média · 6.3
CWE-287 08/03/2026
suitenumerique messages ThreadAccess serializers.py ThreadAccessSerializer improper authentication
A security flaw has been discovered in suitenumerique messages 0.2.0. This issue affects the function ThreadAccessSerializer of the file src/backend/core/api/serializers.py of the component ThreadAccess. The manipulation results in improper authentication. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.3.0 is capable of addressing this issue. The patch is identified as d7729f4b885449f6dee3faf8b5f2a05769fb3d6e. The affected component should be upgraded.
CVE-2026-22867
Média · 5.4
CWE-79 15/01/2026
LaSuite Doc affected by Stored XSS via Interlinking Block
LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 3.8.0 to 4.3.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Interlinking feature. When a user creates a link to another document within the editor, the URL of that link is not validated. An attacker with document editing privileges can inject a malicious javascript: URL that executes arbitrary code when other users click on the link. This vulnerability is fixed in 4.4.0.