Missing Object-Level Authorization in MrDoc Affects Document and Project Security

CVE-2026-111645

What is CVE-2026-111645?

MrDoc version 1.1.1 is susceptible to a critical flaw within the ImportLocalDoc API, where a lack of proper object-level authorization permits authenticated users to manipulate documents belonging to other users. This vulnerability enables attackers to issue PUT requests with arbitrary document IDs, thereby allowing them to publish private drafts or reparent documents. Furthermore, malicious users can inject documents into the system using POST requests with manipulated IDs, raising significant concerns about data integrity and security. Organizations using this version of MrDoc should prioritize updating their software to mitigate the risks associated with this vulnerability.

References