CVE-2026-111364: MinDoc through 2.2-beta.2 IDOR via /api/:key/content/:id GET Branch
MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to read documents from unauthorized books. Attackers holding a non-observer role on any book can name that book and iterate sequential document ids to read markdown and HTML from private books.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
MinDoc instances through 2.2-beta.2 are affected where users have a non-observer role on at least one book. Those users may be able to access documents belonging to private books they are not authorized to read.
What does an attacker need to exploit it?
The attacker needs an authenticated account with a non-observer role on any book. They can supply that book's key and iterate sequential document IDs through the content endpoint to retrieve markdown and HTML from other private books.
What data can be disclosed?
The vulnerable endpoint can expose both markdown and HTML content for documents in unauthorized private books. The issue is confidentiality-only in the provided impact information; no integrity or availability impact is stated.