See how mrdoc compares to other vendors in security performance
mrdoc is vulnerable to Deserialization of Untrusted Data
MrDoc v0.95 and before is vulnerable to Server-Side Request Forgery (SSRF) in the validateurl function of the appdoc/utils.py file.
MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sortdata document ids to publish private drafts and reparent documents, or POST with arbitrary topdoc ids to inject documents.