Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-11369

IDOR in Comment API Allows Cross-Process Comment Read and Write

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
linqi

Description

The Comment API (GET /api/Comment and POST /api/Comment) in the affected application fails to perform authorization checks to verify that the requesting user has access to the object identified by the relatedObjectId. This Insecure Direct Object Reference (IDOR) vulnerability allows any authenticated user to read and write comments on any process across all business units by supplying an arbitrary object GUID.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

linqi GmbH linqi

Default version status: unaffected

  • 0 to ≤ 1.4.8.5affected

References