Search criteria
3 vulnerabilities by suitenumerique
CVE-2026-42185 (GCVE-0-2026-42185)
Vulnerability from cvelistv5 – Published: 2026-05-08 19:23 – Updated: 2026-05-08 19:53
VLAI
Title
People: Privilege Escalation via Missing Role Ceiling in Mail Domain Invitation
Summary
People is an application to handle users and teams, and distribute permissions across La Suite. Prior to version 1.25.0, a user holding the Administrator role on a mail domain could send a crafted invitation request to promote any existing user (including users with no current domain access) to the Owner role. The exploit requires a single authenticated HTTP request and grants full domain ownership immediately, without any acceptance step from the target. This issue has been patched in version 1.25.0.
Severity
5.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/suitenumerique/people/security… | x_refsource_CONFIRM |
| https://github.com/suitenumerique/people/commit/6… | x_refsource_MISC |
| https://github.com/suitenumerique/people/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| suitenumerique | people |
Affected:
< 1.25.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-42185",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-08T19:52:50.446848Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-08T19:53:16.358Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/suitenumerique/people/security/advisories/GHSA-42cf-rv2h-v8rf"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "people",
"vendor": "suitenumerique",
"versions": [
{
"status": "affected",
"version": "\u003c 1.25.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "People is an application to handle users and teams, and distribute permissions across La Suite. Prior to version 1.25.0, a user holding the Administrator role on a mail domain could send a crafted invitation request to promote any existing user (including users with no current domain access) to the Owner role. The exploit requires a single authenticated HTTP request and grants full domain ownership immediately, without any acceptance step from the target. This issue has been patched in version 1.25.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269: Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-08T19:23:00.699Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/suitenumerique/people/security/advisories/GHSA-42cf-rv2h-v8rf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/suitenumerique/people/security/advisories/GHSA-42cf-rv2h-v8rf"
},
{
"name": "https://github.com/suitenumerique/people/commit/6a51b96d8e907483fa8fc489d8714cc35fb4099b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/suitenumerique/people/commit/6a51b96d8e907483fa8fc489d8714cc35fb4099b"
},
{
"name": "https://github.com/suitenumerique/people/releases/tag/v1.25.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/suitenumerique/people/releases/tag/v1.25.0"
}
],
"source": {
"advisory": "GHSA-42cf-rv2h-v8rf",
"discovery": "UNKNOWN"
},
"title": "People: Privilege Escalation via Missing Role Ceiling in Mail Domain Invitation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-42185",
"datePublished": "2026-05-08T19:23:00.699Z",
"dateReserved": "2026-04-25T01:53:21.583Z",
"dateUpdated": "2026-05-08T19:53:16.358Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-3739 (GCVE-0-2026-3739)
Vulnerability from cvelistv5 – Published: 2026-03-08 14:02 – Updated: 2026-03-12 15:00 X_Open Source
VLAI
Title
suitenumerique messages ThreadAccess serializers.py ThreadAccessSerializer improper authentication
Summary
A security flaw has been discovered in suitenumerique messages 0.2.0. This issue affects the function ThreadAccessSerializer of the file src/backend/core/api/serializers.py of the component ThreadAccess. The manipulation results in improper authentication. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.3.0 is capable of addressing this issue. The patch is identified as d7729f4b885449f6dee3faf8b5f2a05769fb3d6e. The affected component should be upgraded.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-287 - Improper Authentication
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.349717 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.349717 | signaturepermissions-required |
| https://vuldb.com/?submit.767329 | third-party-advisory |
| https://github.com/suitenumerique/messages/securi… | exploit |
| https://github.com/suitenumerique/messages/pull/557 | issue-trackingpatch |
| https://github.com/suitenumerique/messages/commit… | patch |
| https://github.com/suitenumerique/messages/releas… | patch |
| https://github.com/suitenumerique/messages/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| suitenumerique | messages |
Affected:
0.2.0
Unaffected: 0.3.0 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-3739",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-12T15:00:06.149306Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-12T15:00:17.476Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"ThreadAccess"
],
"product": "messages",
"vendor": "suitenumerique",
"versions": [
{
"status": "affected",
"version": "0.2.0"
},
{
"status": "unaffected",
"version": "0.3.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "djnn (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in suitenumerique messages 0.2.0. This issue affects the function ThreadAccessSerializer of the file src/backend/core/api/serializers.py of the component ThreadAccess. The manipulation results in improper authentication. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.3.0 is capable of addressing this issue. The patch is identified as d7729f4b885449f6dee3faf8b5f2a05769fb3d6e. The affected component should be upgraded."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-08T14:02:09.949Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-349717 | suitenumerique messages ThreadAccess serializers.py ThreadAccessSerializer improper authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.349717"
},
{
"name": "VDB-349717 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.349717"
},
{
"name": "Submit #767329 | La Suite Numerique messages 0.2.0 IDOR",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.767329"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/suitenumerique/messages/security/advisories/GHSA-7476-6crq-4cw9"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/suitenumerique/messages/pull/557"
},
{
"tags": [
"patch"
],
"url": "https://github.com/suitenumerique/messages/commit/d7729f4b885449f6dee3faf8b5f2a05769fb3d6e"
},
{
"tags": [
"patch"
],
"url": "https://github.com/suitenumerique/messages/releases/tag/v0.3.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/suitenumerique/messages/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-03-07T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-03-07T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-03-07T21:12:35.000Z",
"value": "VulDB entry last update"
}
],
"title": "suitenumerique messages ThreadAccess serializers.py ThreadAccessSerializer improper authentication"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-3739",
"datePublished": "2026-03-08T14:02:09.949Z",
"dateReserved": "2026-03-07T20:07:31.011Z",
"dateUpdated": "2026-03-12T15:00:17.476Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22867 (GCVE-0-2026-22867)
Vulnerability from cvelistv5 – Published: 2026-01-15 16:31 – Updated: 2026-01-15 16:46
VLAI
Title
LaSuite Doc affected by Stored XSS via Interlinking Block
Summary
LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 3.8.0 to 4.3.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Interlinking feature. When a user creates a link to another document within the editor, the URL of that link is not validated. An attacker with document editing privileges can inject a malicious javascript: URL that executes arbitrary code when other users click on the link. This vulnerability is fixed in 4.4.0.
Severity
8.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/suitenumerique/docs/security/a… | x_refsource_CONFIRM |
| https://github.com/suitenumerique/docs/commit/e80… | x_refsource_MISC |
| https://github.com/suitenumerique/docs/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| suitenumerique | docs |
Affected:
>= 3.8.0, < 4.4.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22867",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-15T16:46:46.550304Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-15T16:46:57.161Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "docs",
"vendor": "suitenumerique",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.8.0, \u003c 4.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 3.8.0 to 4.3.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Interlinking feature. When a user creates a link to another document within the editor, the URL of that link is not validated. An attacker with document editing privileges can inject a malicious javascript: URL that executes arbitrary code when other users click on the link. This vulnerability is fixed in 4.4.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-15T16:31:34.397Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/suitenumerique/docs/security/advisories/GHSA-4rwv-ghwh-9rv6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/suitenumerique/docs/security/advisories/GHSA-4rwv-ghwh-9rv6"
},
{
"name": "https://github.com/suitenumerique/docs/commit/e807237dbedbc189230296b81c3aeccc1c04fa77",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/suitenumerique/docs/commit/e807237dbedbc189230296b81c3aeccc1c04fa77"
},
{
"name": "https://github.com/suitenumerique/docs/releases/tag/v4.4.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/suitenumerique/docs/releases/tag/v4.4.0"
}
],
"source": {
"advisory": "GHSA-4rwv-ghwh-9rv6",
"discovery": "UNKNOWN"
},
"title": "LaSuite Doc affected by Stored XSS via Interlinking Block"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-22867",
"datePublished": "2026-01-15T16:31:34.397Z",
"dateReserved": "2026-01-12T16:20:16.746Z",
"dateUpdated": "2026-01-15T16:46:57.161Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}