CVE-2026-91081

Docs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpoint

Published Sep 14, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Description

Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID. Attackers can exploit DNS time-of-check-time-of-use race conditions and shared address space bypasses to access internal network resources and exfiltrate image content.

Analysis

Technical impact

The vulnerability is a server‑side request forgery in the cors‑proxy endpoint of Docs version 5.6.1. Attackers can supply a public document UUID to cause the server to perform outbound HTTP requests, potentially reaching internal network resources and retrieving sensitive image content. This flaw enables confidentiality and integrity compromise of internal systems and may facilitate further lateral movement. The weakness is categorized as CWE‑918.

Affected Systems

The affected product is Docs by suitenumerique, version 5.6.1. No later versions are listed as patched in the CVE data, so any deployment of the 5.6.1 release is vulnerable.

Risk and Exploitability

The CVSS score for this issue is 6.9, indicating a moderate severity vulnerability. The EPSS score is unavailable, so recent exploitation probability is unknown, and the vulnerability is not currently listed in the CISA KEV catalog. Attackers can exploit the unprotected endpoint remotely; the likely attack vector is initiating a crafted HTTP request to the cors‑proxy endpoint to trigger the SSRF. Successful exploitation requires only unauthenticated access, meaning any external user can exploit the flaw without prior credentials.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

suitenumerique

docs

unaffected

Version	Status	Constraints
`0`	affected	≤ 5.6.1

No data.

Vendor Product Versions

Suitenumerique

Docs

Version	Status	Scheme	Platform
`[0,5.6.1]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update Docs to a fixed version that addresses the SSRF flaw or apply the vendor‑supplied patch if available.
Restrict the cors‑proxy endpoint to require authentication, ensuring only authorized internal users can use it.
Block outbound connections from the Docs service to internal network ranges using firewall rules or network segmentation, limiting the potential impact of SSRF.
Restrict DNS resolution for the Docs service to public DNS only, mitigating DNS‑based time‑of‑check/time‑of‑use attacks.

Generated by OpenCVE AI on September 15, 2026 at 12:28 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.507% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/suitenumerique/docs
https://github.com/suitenumerique/docs/blob/v5.6.1/src/backend/core/api/viewsets.py
https://github.com/suitenumerique/docs/blob/v5.6.1/src/backend/core/models.py
https://github.com/suitenumerique/docs/issues/2545
https://www.vulncheck.com/advisories/docs-through-5.6.1-ssrf-via-unauthenticated-cors-proxy-endpoint

History

Sep 20, 2026 1:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 15, 2026 6:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Suitenumerique Suitenumerique docs
Vendors & Products		Suitenumerique Suitenumerique docs

Sep 14, 2026 9:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID. Attackers can exploit DNS time-of-check-time-of-use race conditions and shared address space bypasses to access internal network resources and exfiltrate image content.
Title		Docs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpoint
Weaknesses		CWE-918
References		https://github.com/suitenumerique/docs https://github.com/suitenumerique/docs/blob/v5.6.1/src/backend/core/api/viewsets.py https://github.com/suitenumerique/docs/blob/v5.6.1/src/backend/core/models.py https://github.com/suitenumerique/docs/issues/2545 https://www.vulncheck.com/advisories/docs-through-5.6.1-ssrf-via-unauthenticated-cors-proxy-endpoint
Metrics		cvssV3_1 `{'score': 5.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N'}`