La Suite Docs through 6.0.1 contains an authorization bypass vulnerability that allows authenticated users to write comments into threads of documents they cannot access. This vulnerability enables attackers with knowledge of a thread UUID to route a POST comment request through their own document's resource_id, effectively inserting comments into another document's thread without proper access authorizat [truncated]
CVE-2026-92800 debrief: Docs before 5.4.1 retains websocket collaboration connections after access revocation, allowing attackers with revoked access to retain real-time read and write access to sub-documents. This issue arises because the system fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Defenders should assess exposure and prioritize remediat [truncated]
CVE-2026-91081 is a server-side request forgery vulnerability in the cors-proxy endpoint of Docs through version 5.6.1. This vulnerability allows anonymous attackers to make outbound requests by providing a public document UUID. The vulnerability can be exploited using DNS time-of-check-time-of-use race conditions and shared address space bypasses to access internal network resources and exfiltrate image content.
