Authorization Bypass in ShowDoc by Star7th

CVE-2026-119661

What is CVE-2026-119661?

ShowDoc, through version 3.9.5, is affected by an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint. The vulnerability arises because the system only checks edit permissions for the initial entry ID provided by users. This allows authenticated attackers to manipulate the order of the entry IDs in the request, enabling them to place a benign entry ID first and include the IDs of other users. Consequently, they can permanently delete entries of other users, compromising data integrity and user trust.

References