CVE-2026-111645

MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sortdata document ids to publish private drafts and reparent...

EUVD-2026-103067

MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sortdata document ids to publish private drafts and reparent...

CVE-2026-111645

The MrDoc software (versions through 1.1.1 ) is vulnerable to a missing object-level authorization flaw in the api/import_local_doc/ endpoint. This vulnerability allows authenticated users to perform unauthorized actions on other users' documents and projects. Specifically, an attacker can use PU...

PT-2026-116044

MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sort data document ids to publish private drafts and reparent...