CVE-2026-111645: MrDoc through 1.1.1 Missing Authorization via api/import_local_doc/ Endpoint
MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sortdata document ids to publish private drafts and reparent documents, or POST with arbitrary topdoc ids to inject documents.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated MrDoc user can exploit it. The attacker needs to send requests to the ImportLocalDoc API with identifiers for documents or projects belonging to another user.
What unauthorized actions are possible?
Using PUT requests with arbitrary sort_data document IDs, an attacker can publish private drafts and reparent documents. Using POST requests with arbitrary top_doc IDs, an attacker can inject documents.
Are unauthenticated users affected?
The available information identifies authentication as required for exploitation. It does not indicate that unauthenticated users can use the vulnerable endpoint.
Which MrDoc versions are known to be affected?
MrDoc through version 1.1.1 is identified as affected.