CVE-2026-11369: IDOR in Comment API Allows Cross-Process Comment Read and Write

Synopsis

An insecure direct object reference (IDOR) flaw in the Comment API of linqi (versions up to and including 1.4.8.5) allows any authenticated user to read or write comments on any process object across all business units by supplying an arbitrary object GUID in requests to GET /api/Comment and POST /api/Comment. The API performs no authorization check to confirm the requesting user has permission to access the target object, so a low-privilege account is sufficient to reach comments belonging to other users or business units. Successful exploitation gives an attacker full read access to potentially sensitive process comments and the ability to inject or tamper with comment data across the application. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The Comment API is exposed over the network, so the attacker must be able to reach the application's HTTP endpoint remotely.

• AuthenticationRequired

  Any low-privilege account is sufficient; no elevated or administrative credentials are needed to exploit the missing authorization check.

• Victim interactionNot required

  No victim action is needed; the attacker sends crafted API requests directly without requiring another user to click, open, or approve anything.

• Attack complexityDetail

  Exploit complexity is low: the attack requires only knowledge of or the ability to guess a valid object GUID, with no race conditions or special environmental setup needed.

Blast Radius

• Reads all comments attached to any process object across every business unit by substituting arbitrary GUIDs in GET /api/Comment requests, potentially exposing internal workflow discussions and sensitive operational details.
• Writes or injects arbitrary comment content onto any process object via POST /api/Comment, corrupting audit trails, misleading other users, or embedding false instructions in business process records.
• Enumerates internal process GUIDs through repeated API calls, mapping the structure of business objects and units that the attacker's own account has no legitimate access to.