EUVD-2026-77716
GHSA-53qf-qv6v-5586
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 15, 2026
Unauthenticated server-side request forgery in Suite Numérique Docs through 5.6.1 allows any anonymous attacker who knows a public document UUID to make the application's cors-proxy endpoint issue outbound HTTP requests to arbitrary hosts, including internal network resources. By abusing DNS time-of-check-time-of-use race conditions and shared address-space bypasses, an attacker can reach internal services and exfiltrate image content that the proxy fetches on their behalf. No public exploit code or CISA KEV entry is associated with this issue at time of analysis, and the confidentiality impact is assessed as limited, so this is a moderate-priority SSRF rather than a catastrophic one — but open, unauthenticated Docs instances should be treated as internet-facing proxies into their own networks until patched.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Docs gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID. Attackers can exploit DNS time-of-check-time-of-use race conditions and shared address space bypasses to access internal network resources and exfiltrate image content.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Revoked users of suitenumerique Docs prior to 5.4.1 can retain real-time read and write access to nested sub-documents,
Code injection in the Salty Docs documentation build pipeline (saltyorg/docs) lets an attacker-controlled fork pull requ
The Docker Docs Docker image through 2020-12-14 contains a blank password for the root user. Rated critical severity (CV
Stored XSS in LaSuite Doc versions 3.8.0 through 4.3.0 allows authenticated users with document editing privileges to in
Unauthenticated enumeration of document metadata in LaSuite Doc (suitenumerique/docs) versions 4.8.2 up to but not inclu
An authorization bypass in La Suite Docs through 6.0.0 allows a user with COMMENTER-level access to any document they co
Tencent Docs Desktop 3.9.20 and earlier suffers from Missing SSL Certificate Validation in the update component. Rated h
Exploit-DB