CVE-2026-11369highCWE-639

CVE-2026-11369: fallo de gravedad alta en linqi

IDOR in Comment API Allows Cross-Process Comment Read and Write

Publicada el

Seguir esta CVE+ Monitorear linqi

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.1epss 0.2%
The Comment API (GET /api/Comment and POST /api/Comment) in the affected application fails to perform authorization checks to verify that the requesting user has access to the object identified by the relatedObjectId. This Insecure Direct Object Reference (IDOR) vulnerability allows any authenticated user to read and write comments on any process across all business units by supplying an arbitrary object GUID.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
linqi GmbH · linqi
CVEs relacionadas — linqi

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-11345MEDIUMImproper Authentication Bypass in linqi CDN File AccessEPSS 0.4%CVE-2026-11346MEDIUMServer-Side Request Forgery (SSRF) allowing Internal Network Probing in linqiEPSS 0.2%CVE-2026-11347HIGHHardcoded Cryptographic Keys and Weak IV Generation in linqiEPSS 0.1%