CVE-2026-125375: MrDoc through 1.1.1 Missing Authorization via Project Document Sort Handlers
MrDoc through 1.1.1 contains a missing authorization vulnerability in the projectdocsort and manageprojectdocsort handlers that allows registered users to modify other users' documents by supplying arbitrary document IDs in sortdata. Attackers owning any project can reparent and reorder documents by sequential ID and set their status to draft or removed, hiding published documents.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be a registered MrDoc user and own at least one project. No user interaction is required, and the vulnerable handlers are reachable over the network.
What can an attacker do with access to a project?
By placing arbitrary document IDs in sort_data, the attacker can reparent or reorder documents belonging to other users. They can also change document status to draft or removed, which can hide published documents.
Are deployments running version 1.1.1 affected?
Yes. The affected range is stated as MrDoc through 1.1.1; deployments on that version should be treated as affected unless they have independently applied a fix.
What is a temporary mitigation if updating is not immediately possible?
The provided information does not identify a configuration-based workaround. Restricting access to registered accounts and limiting who can create or own projects may reduce the set of users able to attempt exploitation.