People is a user and team management application used in La Suite. Prior to version 1.25.0 a user who holds the Administrator role on a mail domain can send a specially crafted invitation request that promotes any existing user—whether or not they currently have access—to the Owner role. Granting the Owner role provides full domain ownership without requiring the target to accept the invitation. This flaw is a classic privilege escalation issue as described in CWE‑269.

The affected product is People by suitenumerique. All releases prior to v1.25.0 are vulnerable. Users running these versions with an Administrator role on any mail domain are at risk.

The CVSS score of 5.5 indicates moderate severity. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a single authenticated HTTP request from an account that has the Administrator role on a mail domain. Once the request is made, the target user is instantly promoted to Owner, granting them unrestricted control over the domain without any acceptance step. The exploit path is straightforward and requires no additional conditions.