CVE-2026-119661: ShowDoc through 3.9.5 Authorization Bypass via paramDescLib deleteEntries
ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry id. Authenticated attackers can place their own entry id first and append other users' entry ids to permanently delete those parameter-description entries.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated attacker needs an entry ID they are permitted to edit, plus the IDs of parameter-description entries they want to delete. They can submit their own authorized ID first and append other users' IDs.
What is the impact of a successful exploit?
The attacker can permanently delete parameter-description entries belonging to other users. The provided severity information indicates integrity and availability impact, with no confidentiality impact.
Are unauthenticated or default deployments affected?
The vulnerability requires an authenticated attacker with at least one editable entry, so unauthenticated exploitation is not described. The available data does not state whether any particular default configuration changes exposure.
What can be done if an update cannot be applied immediately?
Restrict access to authenticated accounts that require parameter-description editing and monitor or review deletion activity for this endpoint. The supplied data does not identify a configuration-only workaround.
How can defenders look for exploitation?
Review requests to api/paramDescLib/deleteEntries for submissions containing multiple entry IDs, especially where the first ID belongs to the requesting user but later IDs belong to other users. Also investigate unexpected permanent deletions of parameter-description entries.