La Suite Docs EUVD-2026-102296

Requires: (1) an authenticated account with at least COMMENTER-level access to any one document the attacker controls (PR:L - the PR's regression tests confirm a link-reach COMMENTER role suffices, and an anonymous user on a public EDITOR-reach document can also trigger it); and (2) prior knowledge of a valid thread UUID belonging to the victim document, which is not enumerable and must be leaked or observed (this is the AT:P/AC:H limiting factor). The attack is performed by POSTing a comment to the /documents/{attacker_document_id}/threads/{victim_thread_id}/comments/ endpoint. Limiting factors: impact is write-only (inserting comments) with no read access to the victim document's contents, and the flaw is fixed in versions after 6.0.0 by binding thread_id to the path document_id.

This is a genuine-but-low-priority authorization bypass (CWE-639, insecure direct object reference on thread UUIDs). The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N) and the vendor base score of 2.3 (Low) are mutually consistent and align with the description: exploitation is network-reachable but requires an authenticated low-privilege account (PR:L), a non-trivial precondition of knowing a valid target thread UUID (reflected as AC:H plus AT:P attack-requirements), and yields only limited integrity impact (VI:L) with no confidentiality or availability loss (VC:N/VA:N). No EPSS score, KEV listing, or SSVC decision data was provided, and no public exploit is referenced; exploitation status is therefore 'no public exploit identified at time of analysis'. The one point of friction in the data is AC:H/AT:P versus the description's framing that an attacker merely 'knows a thread UUID' - UUIDs are not enumerable but may leak to collaborators, so the high-complexity rating is defensible rather than a data conflict. Bottom line: a real but narrow write-only authorization flaw affecting a niche product, correctly scored Low; patch when convenient rather than treating as an emergency.

An authenticated low-privilege user who legitimately has comment access to Document A, and who has obtained the UUID of a comment thread belonging to private Document B, sends a POST comment request routed through Document A's resource_id but naming Document B's thread. The server stores the attacker's comment in Document B's thread despite the attacker having no access to Document B. No public proof-of-concept is referenced in the provided data; limited integrity impact only (no data disclosure).