CVE-2026-111169

LowCVSS 3.1/10Last modified Oct 16, 2026

Description

La Suite Docs through 6.0.1 contains an authorization bypass vulnerability that allows authenticated users to write comments into threads of documents they cannot access. Attackers who know a thread UUID can route a POST comment request through their own document's resource_id, inserting comments into another document's thread without access.

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Oct 15, 2026
Last modified
Oct 16, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-111178.8Use after free in Views in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a craftedCVE-2026-1111706.5kedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vulnerability in MatplotlibDataset.save() that allows attackers to write fCVE-2026-1111715.4Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 contains a server-side request forgery vulnerability because _check_ip_blocked() doeCVE-2026-1111725.3@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields() that allows attackers to modify inherited bCVE-2026-1111784.9The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to generic SQL Injection via the 'data[orderby]' parameter in alCVE-2026-111188.8Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a CVE-2026-1111817.5body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single CVE-2026-1111839.8GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute CVE-2026-1111847.8NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to CVE-2026-111199.6Inappropriate implementation in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renCVE-2026-11128.1A vulnerability was found in Sanluan PublicCMS up to 5.202506.d. Affected is the function delete of the file publiccms-trade/src/main/java/cCVE-2026-111209.6Insufficient validation of untrusted input in Enterprise Reporting in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had
CVE-2026-111169: Low severity, CVSS 3.1 | Vulnix