CVE-2026-91081 suitenumerique CVE debrief

Who should care

Defenders responsible for the security of the Docs application, especially those who manage its deployment and configuration, should be aware of this vulnerability and take steps to verify exposure and mitigate potential impact.

Why it matters

CVE-2026-91081 is a server-side request forgery vulnerability in Docs through version 5.6.1 that allows anonymous attackers to make outbound requests. Defenders should verify exposure, assess potential impact, and consider compensating controls. Evidence is limited, and remediation priority requires verification from official sources.

• Verification of exposure of the Docs application to untrusted networks or the internet is required to determine potential impact.
• Exfiltration of internal network resources and image content may occur if the vulnerability is exploited.
• Defenders should assess the potential impact of exploitation on internal network resources and image content.
• Remediation priority is uncertain without vendor confirmation of affected versions and availability of patches.

Technical summary

The vulnerability is caused by a lack of proper validation and sanitization of user-input data in the cors-proxy endpoint of Docs through version 5.6.1. This allows an attacker to provide a public document UUID that can be used to make outbound requests to internal network resources. The vulnerability can be exploited using DNS time-of-check-time-of-use race conditions and shared address space bypasses to access internal network resources and exfiltrate image content. Defenders should prioritize verifying exposure of the Docs application, especially if it is accessible from untrusted networks or the internet, and assess the potential impact of exfiltration of internal network resources and image content. The CV

Defensive priority

Defenders should prioritize verifying exposure of the Docs application, especially if it is accessible from untrusted networks or the internet. They should also assess the potential impact of exfiltration of internal network resources and image content.

Recommended defensive actions

• Verify exposure of the Docs application, especially if it is accessible from untrusted networks or the internet.
• Assess the potential impact of exfiltration of internal network resources and image content.
• Monitor for suspicious activity related to the cors-proxy endpoint.
• Consider implementing compensating controls, such as network segmentation or access controls, to limit the potential impact of exploitation.
• Review vendor guidance and apply patches or updates if available.
• Perform an inventory of assets that may be affected by this vulnerability.
• Track exceptions and retest remediated assets to ensure that the vulnerability has been fully mitigated.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its description, CVSS score, and affected versions. However, the exact scope of affected deployments and the availability of vendor remediation require verification from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.