CVE-2026-76907

🗓️ 24 Sep 2026 15:44:45Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 24 Views🌐 WEB

Unauthenticated document enumeration in LaSuite Doc 4.8.2-5.4.0 via predictable path values.

Reporter	Title	Published	Views	Family All 8
Cvelist	CVE-2026-76907 LaSuite Doc: Public Documents Enumeration	24 Sep 202615:44	–	cvelist
EUVD	EUVD-2026-86251	24 Sep 202615:44	–	euvd
Mend	CVE-2026-76907	24 Sep 202615:44	–	mend
NVD	CVE-2026-76907	24 Sep 202616:17	–	nvd
osv_cve	CVE-2026-76907 LaSuite Doc: Public Documents Enumeration	24 Sep 202615:44	–	osv_cve
Positive Technologies	PT-2026-97860	24 Sep 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-76907: Exposure of Sensitive Information to an Unauthorized Actor	24 Sep 202600:00	–	rapid7
Vulnrichment	CVE-2026-76907 LaSuite Doc: Public Documents Enumeration	24 Sep 202615:44	–	vulnrichment

Vulners

Node

docker docsRange4.8.2–5.4.0

[
  {
    "vendor": "suitenumerique",
    "product": "docs",
    "versions": [
      {
        "version": ">= 4.8.2, < 5.4.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/suitenumerique/docs/security/advisories/GHSA-p8v2-wjj3-3j9w
github	www.github.com/suitenumerique/docs/commit/9ef4a15f5e7437c73ad04d2115a15dba3ffb7a76
github	www.github.com/suitenumerique/docs/releases/tag/v5.4.0

Parameter	Position	Path	Description	CWE
document path	path	/api/v1.0/documents/search/	The endpoint accepts sequential seven-digit document paths to scope descendant searches without requiring the public document UUID, allowing for the enumeration of public document subtrees.	CWE-200, CWE-639

05 Oct 2026 16:17Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.16.5

EPSS0.0025

SSVC

LaSuite Doc GET /api/v1.0/documents/search/document enumeration unauthenticated predictable path values