CVE-2026-76907

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-76907
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-76907.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-76907
Aliases
  • GHSA-p8v2-wjj3-3j9w
Published
2026-09-24T15:44:45Z
Modified
2026-09-25T03:48:41Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
LaSuite Doc: Public Documents Enumeration
Details

LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 4.8.2 until 5.4.0, GET /api/v1.0/documents/search/ accepts sequential seven-digit document paths to scope descendant searches without requiring the caller to possess the public document UUID. An unauthenticated caller can submit an empty search query and iterate predictable path values to enumerate public document subtrees, obtaining document identifiers, titles, creator data, timestamps, and tree metadata. Each disclosed identifier can then be used through normal public-document endpoints to retrieve the document content, and differing 403 Forbidden and 404 Not Found responses reveal whether a guessed path exists. Authenticated users can similarly discover documents with authenticated link reach, while restricted documents remain protected. This issue is fixed in version 5.4.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-200",
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76907.json"
}
References

Affected packages

Git / github.com/suitenumerique/docs

Affected ranges

Type
GIT
Repo
https://github.com/suitenumerique/docs
Events
Introduced
0867ccef1ae4d4dc7fe5465879c3a596ffbd1dd8
Fixed
f5e43a092174d4c3b617dc2383e336a00f826101
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "4.8.2"
        },
        {
            "fixed":  "5.4.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v4.*
v4.8.2
v4.8.2-preprod
v4.8.3
v4.8.4
v4.8.4-preprod
v4.8.5
v4.8.5-preprod
v4.8.6
v5.*
v5.1.0
v5.2.0
v5.2.0-preprod
v5.2.1
v5.2.1-preprod
v5.3.0
v5.3.0-preprod

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-76907.json"