CVE-2026-117563: MrDoc through 1.1.1 Broken Access Control via manage_doc_share
MrDoc through 1.1.1 contains a broken access control vulnerability in the managedocshare type 3 branch that allows authenticated users to modify other users' document share settings because updates lack an ownership check. Attackers can compute predictable share tokens from the MD5 of document ID and username to re-enable disabled shares or remove access codes, exposing private documents.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to MrDoc. The vulnerable functionality lets such a user modify share settings belonging to other users.
What must an attacker know to target a document share?
The attacker can compute predictable share tokens using the MD5 of the document ID and username. This enables targeting shares without an ownership check in the affected update path.
What could an attacker change?
An attacker can re-enable disabled document shares or remove access codes from shares. Either action can expose documents intended to remain private.
Which deployments are affected?
MrDoc through version 1.1.1 is affected. The provided information does not state whether any particular default configuration prevents access to the vulnerable manage_doc_share type 3 branch.
What can be done if updating is not immediately possible?
The provided data identifies the vulnerable operation as manage_doc_share type 3 and shows that authentication is required. Restricting access to share-management functions to trusted users may reduce exposure, but no specific workaround is provided.