CVE-2026-76907: LaSuite Doc: Public Documents Enumeration
LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 4.8.2 until 5.4.0, GET /api/v1.0/documents/search/ accepts sequential seven-digit document paths to scope descendant searches without requiring the caller to possess the public document UUID. An unauthenticated caller can submit an empty search query and iterate predictable path values to enumerate public document subtrees, obtaining document identifiers, titles, creator data, timestamps, and tree metadata. Each disclosed identifier can then be used through normal public-document endpoints to retrieve the document content, and differing 403 Forbidden and 404 Not Found responses reveal whether a guessed path exists. Authenticated users can similarly discover documents with authenticated link reach, while restricted documents remain protected. This issue is fixed in version 5.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LaSuite Docto a version that resolves this vulnerability.Fixed in 5.4.0
Event History
Frequently Asked Questions
Who can exploit this issue, and which documents are exposed?
Unauthenticated callers can enumerate public document subtrees. Authenticated users can also discover documents reachable through authenticated links, but restricted documents remain protected.
What does an attacker need to do to enumerate documents?
No authentication is required for public documents. An attacker can send an empty query to GET /api/v1.0/documents/search/ and iterate predictable sequential seven-digit document paths without knowing a document's public UUID.
What information and content can be obtained?
Enumeration can disclose document identifiers, titles, creator data, timestamps, and tree metadata. Disclosed identifiers can then be used with normal public-document endpoints to retrieve document content.
How can defenders recognize attempted enumeration?
Look for repeated unauthenticated requests to GET /api/v1.0/documents/search/ with empty search queries and sequential seven-digit path values. Repeated probing that produces differing 403 and 404 responses may indicate path-existence discovery attempts.
What version fixes the issue?
The issue is fixed in LaSuite Doc version 5.4.0. Affected versions are from 4.8.2 until 5.4.0.