Executive brief
A security flaw exists in the Linqi application's commenting system, which is used for business process collaboration. An authorized user can exploit this vulnerability to view or modify comments on any business process across the entire organization, regardless of their actual permissions. This could lead to the exposure of sensitive internal discussions or the unauthorized alteration of business records.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the Linqi Comment API (specifically the GET and POST methods at /api/Comment). The application fails to validate if the requesting user has the appropriate permissions for the object specified by the 'relatedObjectId' parameter. By supplying an arbitrary GUID for this parameter, an authenticated attacker can bypass authorization logic to retrieve or inject comments across different business units. The vulnerability is tracked as CWE-639 and requires low-privileged user authentication to exploit.
Affected products
- Linqi Linqi
Timeline
- 2026-06-05: disclosed
- 2026-06-05: advisory