CVE-2026-111645

MEDIUM 5.4

MrDoc through 1.1.1 Missing Authorization via api/import_local_doc/ Endpoint

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sort_data document ids to publish private drafts and reparent documents, or POST with arbitrary top_doc ids to inject documents.

CWE	CWE-639
Vendor	zmister2016
Product	mrdoc
Published	Oct 16, 2026

Stay Ahead of the Next One

Get instant alerts for zmister2016 mrdoc

Be the first to know when new medium vulnerabilities affecting zmister2016 mrdoc are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

zmister2016 / MrDoc

0 ≤ 1.1.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hackmd.io: https://hackmd.io/@hieuPenguinnn/mrdoc-import-local-doc-api-missing-authz-cross-user-publish github.com: https://github.com/zmister2016/MrDoc/blob/v1.1.1/app_doc/views_import.py#L165-L182 vulncheck.com: https://www.vulncheck.com/advisories/mrdoc-through-1.1.1-missing-authorization-via-api-import-local-doc-endpoint

Credits

hieuPenguinnn