Vulnerability · Published Oct 16, 2026 · Assigned by VulnCheck

CVE-2026-111645MrDoc through 1.1.1 Missing Authorization via api/import_local_doc/ Endpoint

Medium 5.4

In plain English

A medium-severity authorization bypass via user-controlled key in MrDoc from zmister2016. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 81.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sort_data document ids to publish private drafts and reparent documents, or POST with arbitrary top_doc ids to inject documents.

Affected products (as reported)

Vendor	Product	Versions
zmister2016	MrDoc	0 – through 1.1.1

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

https://hackmd.io/@hieuPenguinnn/mrdoc-import-local-doc-api-missing-authz-cross-user-publish third-party-advisory
https://github.com/zmister2016/MrDoc/blob/v1.1.1/app_doc/views_import.py#L165-L182 technical-description
VulnCheck Advisory: MrDoc through 1.1.1 Missing Authorization via api/import_local_doc/ Endpoint third-party-advisory