PT-2026-23944 · Unknown · Suitenumerique Messages

Djnn · Published 2026-03-08 · Updated 2026-03-08 · CVE-2026-3739

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SuiteNumerique Messages versions 0.2.0

Description A security flaw exists in the ThreadAccessSerializer function within the src/backend/core/api/serializers.py file of the ThreadAccess component. This flaw leads to improper authentication and can be exploited remotely. The exploit for this issue has been publicly released. The vulnerable component should be upgraded.

Recommendations Upgrade to version 0.3.0.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-3739

GHSA-7476-6CRQ-4CW9

Affected Products

Suitenumerique Messages

References · 14

• 🔥 https://github.com/suitenumerique/messages/security/advisories/GHSA-7476-6crq-4cw9 · Exploit
• https://github.com/suitenumerique/messages/commit/d7729f4b885449f6dee3faf8b5f2a05769fb3d6e · Patch
• https://github.com/suitenumerique/messages/releases/tag/v0.3.0 · Patch
• https://github.com/suitenumerique/messages/pull/557 · Patch
• https://osv.dev/vulnerability/CVE-2026-3739 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3739 · Security Note
• https://vuldb.com/?submit.767329 · Note
• https://t.me/cveNotify/154690 · Telegram Post
• https://twitter.com/CVEnew/status/2030747857532469478 · Twitter Post
• https://github.com/suitenumerique/messages · Note
• https://t.me/CVEtracker/46810 · Telegram Post
• https://vuldb.com/?ctiid.349717 · Note
• https://vuldb.com/?id.349717 · Note
• https://twitter.com/VulmonFeeds/status/2030654801243947424 · Twitter Post