PT-2026-46948 · Linqi Gmbh · Linqi

Published 2026-06-05 · Updated 2026-06-05 · CVE-2026-11369

NVD

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

The Comment API (GET /api/Comment and POST /api/Comment) in the affected application fails to perform authorization checks to verify that the requesting user has access to the object identified by the relatedObjectId. This Insecure Direct Object Reference (IDOR) vulnerability allows any authenticated user to read and write comments on any process across all business units by supplying an arbitrary object GUID.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-11369

Affected Products

Linqi

References · 2

• https://linqi.help/en/reference/security/security-advisories/#security-advisory-insecure-direct-object-reference-idor-in-comment-api-in-linqi · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-11369 · Security Note