EUVD-2026-81060
GHSA-r6pv-x5p3-8fv6
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated prior-access user (PR:L) with a network websocket session; AC:H because it depends on an already-open session at revocation time; retained read and write give C:H/I:H, no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can retain real-time read and write access to sub-documents through open websocket sessions that are never disconnected.
AnalysisAI
Revoked users of suitenumerique Docs prior to 5.4.1 can retain real-time read and write access to nested sub-documents, because the server resets collaboration websocket rooms only for the document whose permissions changed and not for its descendants. An attacker who is a previously authorized user (authenticated, PR:L per the CVSS vector) and who already holds an open websocket session to a sub-document keeps that session alive after their access is revoked at the parent level, allowing continued viewing and editing of content they should no longer reach; the impact is bounded by the requirement that a live session already exist at the moment of revocation (AC:H, AT:P), and no KEV-listed active exploitation has been reported, though publicly available exploit code exists. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to be a previously-authorized Docs user (PR:L) who has already established live websocket collaboration sessions to sub-documents of a parent document, and whose access is then revoked at the parent level. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine authorization/session-expiration flaw (CWE-613) in the suitenumerique Docs collaborative editor, and the CVSS 4.0 vector (7.6, AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N) matches the described impact well: a network-reachable, previously-authenticated user (PR:L) retains both read and write (VC:H/VI:H) to sub-documents after access is revoked. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to suitenumerique Docs 5.4.1 or later, which is the vendor-released patched version: the fix commit d35b81a6ed526dc284c8d0f68b762f2e81ffab13 (https://github.com/suitenumerique/docs/commit/d35b81a6ed526dc284c8d0f68b762f2e81ffab13) adds a reset_service_connections_in_cascade Celery task that walks every descendant document by path prefix and depth and resets each collaboration room, replacing the previous single-room reset in link_configuration, perform_update and perform_destroy. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all suitenumerique Docs deployments and identify any instance running a version prior to 5.4.1; force-terminate active collaboration websocket sessions for users whose access has been revoked, especially where parent-document permissions changed but descendant sub-documents remain accessible, and temporarily disable real-time collaboration on sensitive nested sub-documents if immediate session termination is not feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today