suitenumerique Docs EUVD-2026-81060

Exploitation requires the attacker to be a previously-authorized Docs user (PR:L) who has already established live websocket collaboration sessions to sub-documents of a parent document, and whose access is then revoked at the parent level. The flaw is specific to hierarchical/nested documents: the pre-5.4.1 server reset collaboration connections only for the target document, not its descendants, so descendant sessions persist. Limiting factors: the attacker must hold an open, uninterrupted websocket session at the time of revocation (AC:H/AT:P timing/state dependency), must have had prior legitimate access, and the target must be running Docs before 5.4.1 with the real-time collaboration server in use; a simple re-authentication or fresh page load would not grant access, so this is an offboarding/session-persistence abuse rather than a fresh unauthenticated intrusion.

This is a genuine authorization/session-expiration flaw (CWE-613) in the suitenumerique Docs collaborative editor, and the CVSS 4.0 vector (7.6, AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N) matches the described impact well: a network-reachable, previously-authenticated user (PR:L) retains both read and write (VC:H/VI:H) to sub-documents after access is revoked. The AC:H and AT:P metrics correctly capture that exploitation is not trivially repeatable on demand - the attacker must already hold an open websocket collaboration session at the moment access is revoked, and the flaw only manifests for descendant documents of the revoked parent. Exploitation signals are mixed but lean toward real priority: a public POC exists (geo-chen/oss write-up) and VulnCheck published an advisory, but there is no CISA KEV listing and no EPSS provided, so this is 'publicly available exploit code exists' rather than confirmed active exploitation - treat as a credible, documented weakness rather than a mass-exploited threat. The main tempering factor is prerequisite state (an already-established, still-open session and a prior grant that is being revoked), which makes this an insider/offboarding-abuse risk rather than an internet-wide unauthenticated compromise. No data is strongly conflicting; the vector and description are consistent.

A user is granted access to a parent document (and thereby its sub-documents) in Docs, opens a real-time collaboration websocket session, and an administrator later revokes their access at the parent. Because the server only reset connections on the parent and never cascaded to descendants, the attacker's existing websocket sessions to child documents are never torn down, so they keep reading and editing sub-documents in real time. A public proof-of-concept demonstrating this stale-session persistence is available from VulnCheck's referenced write-up.