CVE-2026-76907
Deferred Deferred - Pending Action

Information Disclosure in LaSuite Doc

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description
LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 4.8.2 until 5.4.0, GET /api/v1.0/documents/search/ accepts sequential seven-digit document paths to scope descendant searches without requiring the caller to possess the public document UUID. An unauthenticated caller can submit an empty search query and iterate predictable path values to enumerate public document subtrees, obtaining document identifiers, titles, creator data, timestamps, and tree metadata. Each disclosed identifier can then be used through normal public-document endpoints to retrieve the document content, and differing 403 Forbidden and 404 Not Found responses reveal whether a guessed path exists. Authenticated users can similarly discover documents with authenticated link reach, while restricted documents remain protected. This issue is fixed in version 5.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-25
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-76907
EUVD
EUVD-2026-86251

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
suitenumerique docs From 4.8.2 (inc) to 5.4.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows unauthenticated users to enumerate public documents in LaSuite Doc by submitting sequential seven-digit paths to a search endpoint. The system incorrectly uses predictable paths instead of random UUIDs, enabling attackers to discover document identifiers, titles, metadata, and content through normal endpoints. The flaw acts as an existence oracle, revealing document existence via HTTP response codes.

Detection Guidance

To detect this vulnerability, monitor HTTP requests to the GET /api/v1.0/documents/search/ endpoint. Look for sequential seven-digit path values in requests with empty search queries. Check for differing HTTP response codes (403 Forbidden vs 404 Not Found) which may indicate document existence. Use tools like curl to test paths: curl -i 'http://target/api/v1.0/documents/search/?path=0000001' and observe responses.

Impact Analysis

Attackers can harvest sensitive document details and full content of public documents without authorization. They can also determine which documents exist, even if restricted, by analyzing response codes. The impact includes full disclosure of public document information and potential exposure of documents shared with authenticated users.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection regulations like GDPR and HIPAA by exposing sensitive information without proper authorization. It enables unauthorized access to document contents and metadata, which could include personal or protected health data.

Mitigation Strategies

Upgrade to version 5.4.0 or later immediately. If upgrading is not possible, restrict access to the /api/v1.0/documents/search/ endpoint via firewall rules or network segmentation. Implement rate limiting on this endpoint to prevent brute force enumeration attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76907. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart