LaSuite Doc EUVD-2026-86251

No special conditions - remote unauthenticated exploitation against default configurations of LaSuite Doc (suitenumerique/docs) versions 4.8.2 up to but not including 5.4.0, targeting the GET /api/v1.0/documents/search/ endpoint. Exploitation is inherently LIMITED to PUBLIC documents (and, for authenticated callers, documents reachable via authenticated link sharing); documents with restricted access remain protected. The disclosure relies on the search endpoint accepting a 'path' parameter to scope descendant searches without requiring possession of the document UUID, plus a distinguishable 403 Forbidden vs 404 Not Found response acting as a path-existence oracle - both removed in 5.4.0, which scopes search by resolved document ID instead of path prefix.

This is a genuine but moderate-severity information-disclosure issue, not a critical one. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N = 6.5) correctly reflects a network-reachable, low-complexity, unauthenticated flaw with limited impact. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so exploitation status is 'no public exploit identified at time of analysis' - this is a self-reported GitHub Security Advisory (GHSA-p8v2-wjj3-3j9w) with a confirmed fix commit rather than an actively-exploited vulnerability. The 'automatable' dimension is high: enumeration of sequential seven-digit paths plus a 403-vs-404 response oracle is trivially scriptable, so opportunistic mass-enumeration against exposed instances is plausible despite the absence of a published PoC. One note of caution on the vector: NVD assigns I:L, but the described behavior is read-only enumeration and content retrieval of already-public documents - I see no integrity impact and would rate I:N (see assessed vector). Net: prioritize patching internet-exposed LaSuite Doc instances, but this is a confidentiality/exposure problem, not RCE or a takeover.

An unauthenticated attacker sends GET /api/v1.0/documents/search/ with an empty query and iterates predictable seven-digit path values, using the differing 403/404 responses as an oracle to map which public document subtrees exist. Harvested identifiers, titles, creator data, and tree metadata are then fed into normal public-document endpoints to pull the actual document content. No public PoC was provided, but the attack is fully scriptable and requires no credentials or user interaction.