CVE-2026-120427: MrDoc through 1.1.1 Missing Authorization via get_doctemp Template Read

Published Nov 2, 2026

Updated

MrDoc through 1.1.1 contains a missing authorization vulnerability in the getdoctemp view that allows authenticated users to read other users' document templates. Attackers can enumerate the sequential doctempid POST parameter to retrieve the private template content of every user on the instance.

Event History

Nov 2, 2026

CVE Published

via OSV·02:28 PM

Data Sourced

via OSV·02:28 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker needs to be authenticated to the MrDoc instance. They can then submit sequential doctemp_id values to the get_doctemp view to retrieve template content belonging to other users.

What data is exposed if exploitation succeeds?

The vulnerability exposes private document-template content from other users on the same MrDoc instance. The provided information indicates confidentiality impact only; it does not describe modification or availability impact.

Which deployments should be prioritized for remediation?

Any MrDoc deployment through 1.1.1 where multiple authenticated users create or store private document templates should be prioritized, because any authenticated user may be able to enumerate and read other users' templates.

CVE-2026-120427: MrDoc through 1.1.1 Missing Authorization via get_doctemp Template Read

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

What data is exposed if exploitation succeeds?

Which deployments should be prioritized for remediation?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What data is exposed if exploitation succeeds?

Which deployments should be prioritized for remediation?