CVE-2026-111364

The software MinDoc (versions through 2.2-beta.2 ) contains an Insecure Direct Object Reference (IDOR) vulnerability in the DocumentController.Content component. This flaw allows authenticated users with a non-observer role on any book to access and read markdown and HTML content from unauthorize...

CVE-2026-111364 MinDoc through 2.2-beta.2 IDOR via /api/:key/content/:id GET Branch

MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to read documents from unauthorized books. Attackers holding a non-observer role on any book can name that book and iterate sequential document ids to...