Vulnerability Description
The Comment API (GET /api/Comment and POST /api/Comment) in the affected application fails to perform authorization checks to verify that the requesting user has access to the object identified by the relatedObjectId. This Insecure Direct Object Reference (IDOR) vulnerability allows any authenticated user to read and write comments on any process across all business units by supplying an arbitrary object GUID.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-11369?
CVE-2026-11369 is a documented vulnerability. The Comment API (GET /api/Comment and POST /api/Comment) in the affected application fails to perform authorization checks to verify that the requesting user has access to the object identified by the...
How severe is CVE-2026-11369?
CVSS scoring is not yet available for CVE-2026-11369. Check NVD for updates.
Is there a patch for CVE-2026-11369?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.