CVE-2026-111645

The MrDoc software (versions through 1.1.1 ) is vulnerable to a missing object-level authorization flaw in the api/import_local_doc/ endpoint. This vulnerability allows authenticated users to perform unauthorized actions on other users' documents and projects. Specifically, an attacker can use PU...

CVE-2026-111645 MrDoc through 1.1.1 Missing Authorization via api/import_local_doc/ Endpoint

MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sortdata document ids to publish private drafts and reparent...