CVE-2026-120427

MEDIUM 4.3

MrDoc through 1.1.1 Missing Authorization via get_doctemp Template Read

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

MrDoc through 1.1.1 contains a missing authorization vulnerability in the get_doctemp view that allows authenticated users to read other users' document templates. Attackers can enumerate the sequential doctemp_id POST parameter to retrieve the private template content of every user on the instance.

CWE	CWE-639
Vendor	zmister2016
Product	mrdoc
Published	Nov 2, 2026

Stay Ahead of the Next One

Get instant alerts for zmister2016 mrdoc

Be the first to know when new medium vulnerabilities affecting zmister2016 mrdoc are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

zmister2016 / MrDoc

0 ≤ 1.1.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/zmister2016/MrDoc/commit/ec93679499fb6ea88ce868ffc9169fe025917095 github.com: https://github.com/zmister2016/MrDoc/blob/v1.1.1/app_doc/views.py#L1983-L1996 github.com: https://github.com/zmister2016/MrDoc/releases/tag/v1.1.1 hackmd.io: https://hackmd.io/@hieund/mrdoc-get-doctemp-missing-owner-check-cross-user-template-read vulncheck.com: https://www.vulncheck.com/advisories/mrdoc-through-1.1.1-missing-authorization-via-get-doctemp-template-read

Credits

hieuPenguinnn yangjian