Insecure Direct Object Reference Vulnerability in MinDoc by Mindoc
CVE-2026-111364

7.1HIGH

Key Information:

Vendor

Mindoc-org

Status
Mindoc
Vendor
CVE Published:
15 October 2026

What is CVE-2026-111364?

MinDoc versions up to 2.2-beta.2 are susceptible to an insecure direct object reference (IDOR) vulnerability in the DocumentController.Content module. This flaw permits authenticated users to access private documents from unauthorized books merely by manipulating document IDs. Attackers with a non-observer role can exploit this weakness by sequentially iterating document IDs within any book they can name, leading to potential exposure of sensitive markdown and HTML content.

Affected Version(s)

MinDoc 0 <= 2.2-beta.2

References

https://hackmd.io/@hieuPenguinnn/mindoc-api-content-get-c...
third-party-advisory
https://github.com/mindoc-org/mindoc/blob/v2.2-beta.2/con...
technical-description
https://github.com/mindoc-org/mindoc/blob/v2.2-beta.2/rou...
technical-description

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.