CVE-2026-11369

IDOR in Comment API Allows Cross-Process Comment Read and Write

CVSS 7.1 HIGHEPSS 0.2%CWE-639

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 7.1EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

05 jun 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

The Comment API (GET /api/Comment and POST /api/Comment) in the affected application fails to perform authorization checks to verify that the requesting user has access to the object identified by the relatedObjectId. This Insecure Direct Object Reference (IDOR) vulnerability allows any authenticated user to read and write comments on any process across all business units by supplying an arbitrary object GUID.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Produtos afetados

linqi GmbH · linqi

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://linqi.help/en/reference/security/security-advisories/#security-advisory-insecure-direct-object-reference-idor-in-comment-api-in-linqi