What’s Vulnerable › Vulnerabilities

CVE-2026-91081: Docs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpoint

• Severity: medium (CVSS 5.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-14 · updated 2026-09-23
• Weakness: CWE-918

Description

Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID. Attackers can exploit DNS time-of-check-time-of-use race conditions and shared address space bypasses to access internal network resources and exfiltrate image content.

Affected products

• suitenumerique docs: through 5.6.1

References

• https://github.com/suitenumerique/docs
• https://github.com/suitenumerique/docs/blob/v5.6.1/src/backend/core/api/viewsets.py
• https://github.com/suitenumerique/docs/blob/v5.6.1/src/backend/core/models.py
• https://github.com/suitenumerique/docs/issues/2545
• https://www.vulncheck.com/advisories/docs-through-5.6.1-ssrf-via-unauthenticated-cors-proxy-endpoint

Get alerted when CVE-2026-91081 or the next vulnerability affects your stack