Missing Authorization Vulnerability in MrDoc Document Management System
CVE-2026-125375

5.3MEDIUM

Key Information:

Vendor

Zmister2016

Status
Mrdoc
Vendor
CVE Published:
9 November 2026

What is CVE-2026-125375?

The MrDoc document management system, up to version 1.1.1, is susceptible to a missing authorization vulnerability within its project document sort and management handlers. This flaw allows registered users to manipulate other users' documents by sending arbitrary document IDs in the sort_data input. Consequently, attackers with access to any project can alter the hierarchy of documents by their IDs, and switch their statuses to either draft or removed. This action effectively obscures published documents from view, posing a significant risk to document integrity and confidentiality.

Affected Version(s)

MrDoc 0 <= 1.1.1

References

https://github.com/zmister2016/MrDoc/issues/209
issue-tracking
https://github.com/zmister2016/MrDoc
product
https://github.com/zmister2016/MrDoc/blob/40e43bbdf105029...
technical-description

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.