CVE-2026-76907

LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 4.8.2 until 5.4.0, GET /api/v1.0/documents/search/ accepts sequential seven-digit document paths to scope descendant searches without requiring the caller to possess the public document UUID. An unauthenticated caller can submit an empty search query and iterate predictable path values to enumerate public document subtrees, obtaining document identifiers, titles, creator data, timestamps, and tree metadata. Each disclosed identifier can then be used through normal public-document endpoints to retrieve the document content, and differing 403 Forbidden and 404 Not Found responses reveal whether a guessed path exists. Authenticated users can similarly discover documents with authenticated link reach, while restricted documents remain protected. This issue is fixed in version 5.4.0.

• CWE-200
• CWE-639

• https://github.com/suitenumerique/docs/commit/9ef4a15f5e7437c73ad04d2115a15dba3ffb7a76
• https://github.com/suitenumerique/docs/releases/tag/v5.4.0
• https://github.com/suitenumerique/docs/security/advisories/GHSA-p8v2-wjj3-3j9w

Published

Sep 24, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7690A weakness has been identified in Wavlink WL-WN570HA1 R70HA1…9.8
• CVE-2026-76900CordysCRM is an open source AI-powered customer relationship…6.8
• CVE-2026-76901CordysCRM is an open source AI-powered customer relationship…5.8
• CVE-2026-76902CordysCRM is an open source AI-powered customer relationship…5
• CVE-2026-76904GeoTools is an open source Java library that provides tools …9.8
• CVE-2026-76905kin-openapi is a Go project for handling OpenAPI files. From…7.5
• CVE-2026-76909Unleash is an open-source feature management platform. Prior…2.1
• CVE-2026-7691A security vulnerability has been detected in Wavlink WL-WN5…6.3
• CVE-2026-76910Unleash is an open-source feature management platform. Prior…5.3
• CVE-2026-76917Bluetooth AVRCP Profile protocol dissector crash in 4.6.0 to…5.5
• CVE-2026-76918SSH protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to …5.5
• CVE-2026-76919ESS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to …7.5