CVE-2026-111645: MrDoc through 1.1.1 Missing Authorization via api/import_local_doc/ Endpoint

Q: Who can exploit this issue?

An authenticated MrDoc user can exploit it. The attacker needs to send requests to the ImportLocalDoc API with identifiers for documents or projects belonging to another user.

Q: What unauthorized actions are possible?

Using PUT requests with arbitrary sort_data document IDs, an attacker can publish private drafts and reparent documents. Using POST requests with arbitrary top_doc IDs, an attacker can inject documents.

Q: Are unauthenticated users affected?

The available information identifies authentication as required for exploitation. It does not indicate that unauthenticated users can use the vulnerable endpoint.

Q: Which MrDoc versions are known to be affected?

MrDoc through version 1.1.1 is identified as affected.

Published Oct 16, 2026

Updated

MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sortdata document ids to publish private drafts and reparent documents, or POST with arbitrary topdoc ids to inject documents.

Affected Software

1 affected component

mrdoc mrdoc<=1.1.1

Event History

Oct 16, 2026

CVE Published

via MITRE·05:39 PM

Data Sourced

via MITRE·05:39 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated MrDoc user can exploit it. The attacker needs to send requests to the ImportLocalDoc API with identifiers for documents or projects belonging to another user.

What unauthorized actions are possible?

Using PUT requests with arbitrary sort_data document IDs, an attacker can publish private drafts and reparent documents. Using POST requests with arbitrary top_doc IDs, an attacker can inject documents.

Are unauthenticated users affected?

The available information identifies authentication as required for exploitation. It does not indicate that unauthenticated users can use the vulnerable endpoint.

Which MrDoc versions are known to be affected?

MrDoc through version 1.1.1 is identified as affected.

CVE-2026-111645: MrDoc through 1.1.1 Missing Authorization via api/import_local_doc/ Endpoint

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What unauthorized actions are possible?

Are unauthenticated users affected?

Which MrDoc versions are known to be affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What unauthorized actions are possible?

Are unauthenticated users affected?

Which MrDoc versions are known to be affected?