Broken Access Control in MrDoc Products by ZMister Affecting Document Sharing

CVE-2026-117563

What is CVE-2026-117563?

MrDoc versions up to 1.1.1 are vulnerable to a broken access control issue in the manage_doc_share feature. This flaw allows authenticated users to unintentionally alter other users' document sharing settings due to insufficient ownership checks. By leveraging predictable share tokens derived from the MD5 hash of the document ID and username, attackers can reinstate disabled shares or eliminate access controls. This poses a significant risk as it could lead to unauthorized access to private documents, compromising user confidentiality and document security.

References