Information Disclosure in LaSuite Doc: Unauthenticated Access to Document Metadata

CVE-2026-76907

What is CVE-2026-76907?

LaSuite Doc, a collaborative note-taking and documentation platform, is susceptible to an information disclosure vulnerability. This occurs when unauthenticated users can exploit the GET /api/v1.0/documents/search/ endpoint to sequentially access seven-digit document paths without needing a public document UUID. By issuing an empty search query, an attacker can enumerate public document subtrees, gaining access to sensitive data such as document identifiers, titles, creator information, timestamps, and tree metadata. Furthermore, differing responses (403 Forbidden and 404 Not Found) provide attackers with clues about the existence of certain paths. Although authenticated users may retrieve additional information through shared links, restricted documents remain safeguarded. This vulnerability was resolved in version 5.4.0.

References