Suite Numérique People EUVD-2026-28821

Exploitation requires an authenticated account with the Administrator role on a mail domain within Suite Numérique People. The vulnerability affects invitations sent to existing users regardless of their current access level to the domain, meaning a user with no prior domain access can be promoted to Owner. No special deployment configuration or feature enablement is required; the default invitation creation functionality is vulnerable. The attack requires HTTP network access to the People API endpoint and valid Administrator authentication credentials. User interaction is not required from the target user-the Owner status is granted immediately upon invitation creation without any acceptance step. Non-Administrator users cannot exploit this vulnerability; only those holding the Administrator role on a mail domain can craft malicious invitations.

The CVSS score of 5.5 (AV:N/AC:L/PR:H) reflects high privileges required (PR:H), low attack complexity, and network accessibility, but the real-world risk is substantial due to several factors: First, the vulnerability requires only a single authenticated HTTP request with no user interaction (UI:N), making exploitation trivial once an attacker obtains Administrator credentials. Second, the integrity impact (I:H) grants immediate Owner status without acceptance, fundamentally breaking organizational hierarchy. Third, in multi-tenant SaaS deployments of La Suite, a compromised or malicious domain administrator can immediately escalate to full domain ownership, affecting all downstream services sharing domain permissions. The CVSS vector underestimates impact because it assumes Security Scope Unchanged (S:U), but domain ownership typically cascades permissions across La Suite services. EPSS exploitation probability data is unavailable, but the simplicity of exploitation (single API call with crafted JSON) and the absence of any acceptance requirement suggest high practical exploitability among threat actors with administrative access. This is not a theoretical privilege escalation but a direct, immediate ownership grant vulnerability.

An attacker with Administrator credentials on a mail domain (obtained via credential compromise, insider threat, or social engineering targeting domain admins) sends a crafted HTTP POST request to the domain invitations API endpoint with role set to 'owner' and targets an existing user's email address. The API immediately creates or accepts the invitation without requiring the target user to confirm, granting the target (or the attacker, if they control that email) full Owner privileges on the domain. The attacker then uses Owner access to modify domain settings, create additional administrator accounts, or impersonate domain users.