Description
MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sort_data document ids to publish private drafts and reparent documents, or POST with arbitrary top_doc ids to inject documents.
Published: 2026-10-16
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 16 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
Description MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sort_data document ids to publish private drafts and reparent documents, or POST with arbitrary top_doc ids to inject documents.
Title MrDoc through 1.1.1 Missing Authorization via api/import_local_doc/ Endpoint
First Time appeared Mrdoc
Mrdoc mrdoc
Weaknesses CWE-639
CPEs cpe:2.3:a:mrdoc:mrdoc:*:*:*:*:*:*:*:*
Vendors & Products Mrdoc
Mrdoc mrdoc
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Mrdoc Mrdoc
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-19T13:13:46.523Z

Reserved: 2026-10-16T14:31:14.158Z

Link: CVE-2026-111645

cve-icon Vulnrichment

Updated: 2026-10-19T13:13:35.549Z

cve-icon NVD

Status : Deferred

Published: 2026-10-16T18:17:45.303

Modified: 2026-10-19T14:16:58.440

Link: CVE-2026-111645

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T18:45:13Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key