Executive brief
People is a user and team management application used within the La Suite Numérique platform. A security flaw allows users with administrative access to a specific mail domain to bypass permission limits and promote any user to the 'Owner' role. This could lead to an unauthorized takeover of a domain, allowing an attacker to delete the domain or lock out the legitimate owners.
Technical details
A privilege escalation vulnerability exists in the People service of La Suite Numérique due to an improper role ceiling check in the invitation logic. Specifically, the 'MailDomainInvitationViewset.create()' method in 'viewsets.py' handles 'EmailAlreadyKnownException' by directly creating a 'MailDomainAccess' record using the role provided in the raw request body. This bypasses the hierarchy validation found in other parts of the application. An authenticated attacker with the 'Administrator' role can send a single POST request to the invitations endpoint to grant 'Owner' status to any existing user without their interaction. This allows for domain hijacking and persistence. The issue is fixed in version 1.25.0.
Affected products
- suitenumerique People (La Suite Numérique) < 1.25.0
Timeline
- 2026-02-22: disclosed: Vulnerability identified and reported to vendor
- 2026-04-20: patched: Version 1.25.0 released and security advisory published
- 2026-05-08: advisory: CVE-2026-42185 published