La Suite Docs through 6.0.1 contains an authorization bypass flaw that allows an authenticated user to write comments in document threads that the user should not have access to. The weakness resides in the way the API binds a comment POST request to a thread’s parent document identifier, permitting the caller to supply a different resource_id than the one associated with the thread. As a result, unprivileged users can inject content into unauthorized document discussions, affecting the integrity of the data. The issue is categorized under CWE‑639, which involves missing authorization checks for data manipulation.

The affected product is La Suite Docs, specifically all releases up through version 6.0.1. Users running version 6.0.1 or earlier are at risk, while newer releases beyond that are presumed to contain a fix.

The CVSS score is 2.3, indicating low overall severity. The EPSS score is below 1%, suggesting a low probability of exploitation in the wild. The vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires the attacker to be authenticated and to know a thread UUID; once those conditions are met, the attacker can post a comment by simply changing the resource_id value. The attack vector is likely internal or impersonated, but because it involves an explicit authentication step, it does not pose a remote code execution risk. Overall, the risk is low but not negligible for environments where comment integrity is critical.