CVE-2026-11369 IDOR in Comment API Allows Cross-Process Comment Read and Write
Authenticated users can read and write comments on any process across all business units by manipulating object IDs in the Comment API.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-11369?
CVE-2026-11369 is a high-severity missing authorization vulnerability in linqi, published on 5 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Comment API (GET /api/Comment and POST /api/Comment) in the affected application fails to perform authorization checks to verify that the requesting user has access to the object identified by the relatedObjectId. This Insecure Direct Object Reference (IDOR) vulnerability allows any authenticated user to read and write comments on any process across all business units by supplying an arbitrary object GUID.
Weakness: CWE-639
Which versions are affected by CVE-2026-11369?
How do I fix CVE-2026-11369?
No fix has been published for CVE-2026-11369 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-11369 being exploited?
There is no known exploitation of CVE-2026-11369 in the wild and no public exploit code.
Sources
Also known as GHSA-8rq4-278f-v3vj.