---
id: CVE-2026-119661
title: ShowDoc through 3.9.5 Authorization Bypass via paramDescLib deleteEntries
summary: >-
  ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the
  api/paramDescLib/deleteEntries endpoint that checks edit permission only for
  the first supplied entry id. Authenticated attackers can place their own entry
  id fi…
severity: medium
cvss: 4.2
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-639
vendor: star7th
product: ShowDoc
affected:
  - ShowDoc <= 3.9.5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-30T15:21:25.839972Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T15:52:32.619Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119661'
references:
  - url: 'https://github.com/star7th/showdoc/issues/2612'
  - url: >-
      https://github.com/star7th/showdoc/commit/53228511e656904abf7841c3d25ff78a4b5ce9c2
  - url: >-
      https://github.com/star7th/showdoc/blob/v3.9.5/server/app/Api/Controller/ParamDescLibController.php#L545-L584
  - url: >-
      https://hackmd.io/@hieuPenguinnn/showdoc-paramdesclib-cross-item-idor-delete
  - url: 'https://github.com/star7th/showdoc'
  - url: >-
      https://www.vulncheck.com/advisories/showdoc-through-3.9.5-authorization-bypass-via-paramdesclib-deleteentries
    label: >-
      VulnCheck Advisory: ShowDoc through 3.9.5 Authorization Bypass via
      paramDescLib deleteEntries
tags:
  - cve.org
epss: 0.00379
epssPercentile: 0.32089
ingestedAt: '2026-11-05T16:07:30.504Z'
---

## Overview

ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry id. Authenticated attackers can place their own entry id first and append other users' entry ids to permanently delete those parameter-description entries.

## Affected

- `ShowDoc <= 3.9.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.