The vulnerability is an IDOR in the Comment API of Linqi. Because the application does not verify the requesting user’s permissions for the relatedObjectId, an authenticated user can read or submit comments on any process, including those belonging to other business units. This flaw enables arbitrary disclosure and tampering of business process data, compromising confidentiality and integrity across the organization.

Linqi GmbH’s Linqi application is affected. The specific product and version details are not disclosed, but the flaw exists in any deployment that includes the Comment API endpoints (GET /api/Comment and POST /api/Comment).

The CVSS score of 7.1 indicates a high‑severity vulnerability. The EPSS score is not available, so the exact likelihood of exploitation cannot be quantified, though the flaw is readily exploitable by any authenticated user who can supply an arbitrary GUID. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw simply by including an arbitrary relatedObjectId in a request, with no additional conditions.