CVE-2026-119661
ShowDoc through 3.9.5 Authorization Bypass via paramDescLib deleteEntries
CVSS Score
4.2
EPSS Score
0.0%
EPSS Percentile
0th
ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry id. Authenticated attackers can place their own entry id first and append other users' entry ids to permanently delete those parameter-description entries.
| CWE | CWE-639 |
| Vendor | star7th |
| Product | showdoc |
| Published | Oct 30, 2026 |
| Last Updated | Oct 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for star7th showdoc
Be the first to know when new medium vulnerabilities affecting star7th showdoc are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low
Affected Versions
star7th / ShowDoc
0 ≤ 3.9.5
References
github.com: https://github.com/star7th/showdoc/issues/2612 github.com: https://github.com/star7th/showdoc/commit/53228511e656904abf7841c3d25ff78a4b5ce9c2 github.com: https://github.com/star7th/showdoc/blob/v3.9.5/server/app/Api/Controller/ParamDescLibController.php#L545-L584 hackmd.io: https://hackmd.io/@hieuPenguinnn/showdoc-paramdesclib-cross-item-idor-delete github.com: https://github.com/star7th/showdoc vulncheck.com: https://www.vulncheck.com/advisories/showdoc-through-3.9.5-authorization-bypass-via-paramdesclib-deleteentries
Credits
hieuPenguinnn star7th