Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck
CVE-2026-119661ShowDoc through 3.9.5 Authorization Bypass via paramDescLib deleteEntries
Medium 4.2
In plain English
A medium-severity authorization bypass via user-controlled key in ShowDoc from star7th. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).
Severity (CVSS 3.1)4.2Medium
Exploit odds (30 days)0.4%top 67.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry id. Authenticated attackers can place their own entry id first and append other users' entry ids to permanently delete those parameter-description entries.
Affected products (as reported)
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
References
- https://github.com/star7th/showdoc/issues/2612 issue-tracking
- https://github.com/star7th/showdoc/commit/53228511e656904abf7841c3d25ff78a4b5ce9c2 patch
- https://github.com/star7th/showdoc/blob/v3.9.5/server/app/Api/Controller/ParamDescLibController.php#L545-L584 technical-description
- https://hackmd.io/@hieuPenguinnn/showdoc-paramdesclib-cross-item-idor-delete third-party-advisory
- https://github.com/star7th/showdoc product
- VulnCheck Advisory: ShowDoc through 3.9.5 Authorization Bypass via paramDescLib deleteEntries third-party-advisory