CVE-2026-111645
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sort_data document ids to publish private drafts and reparent documents, or POST with arbitrary top_doc ids to inject documents.
Risk Assessment
An authenticated attacker can modify other users' documents and projects, leading to data integrity breaches and unauthorized changes. The organization may face legal consequences and loss of user trust.
Recommendation
Update MrDoc to a version newer than 1.1.1 if available, or implement object-level authorization checks in the ImportLocalDoc API. Restrict access to this API and monitor for unusual modification requests.
Other vulnerabilities in MrDoc
See all- CVE-2026-120427Medium
MrDoc through 1.1.1 contains a missing authorization vulnerability in the get_doctemp view that allows authenticated users to read other users' document templates. Attackers can enumerate the sequential doctemp_id POST parameter to retrieve the private template content of every user on the instance.
- CVE-2026-117563Medium
MrDoc through 1.1.1 contains a broken access control vulnerability in the manage_doc_share type 3 branch that allows authenticated users to modify other users' document share settings because updates lack an ownership check. Attackers can compute predictable share tokens from the MD5 of document ID and username.
Original NVD description (English source)
MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sort_data document ids to publish private drafts and reparent documents, or POST with arbitrary top_doc ids to inject documents.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS