PT-2026-46948 · Linqi Gmbh · Linqi
CVE-2026-11369
·
Published
2026-06-05
·
Updated
2026-06-05
CVSS v4.0
7.1
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
The product name cannot be determined (affected versions not specified)
Description
The Comment API endpoints "/api/Comment" (GET and POST) fail to perform authorization checks to verify if the requesting user has access to the object identified by the
relatedObjectId variable. This Insecure Direct Object Reference (IDOR)—a flaw where an application provides direct access to objects based on user-supplied input—allows any authenticated user to read and write comments on any process across all business units by providing an arbitrary object GUID.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linqi