MrDoc vulnerabilities
CVEs whose affected-version data names the MrDoc package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-117563Medium· 5.4MrDoc through 1.1.1 Broken Access Control via manage_doc_share
MrDoc through 1.1.1 contains a broken access control vulnerability in the manage_doc_share type 3 branch that allows authenticated users to modify other users' document share settings because updates lack an ownership check. Attackers ca…
▾ Sunlitzmister2016 · MrDocvia CVEORG
CVE-2026-111645Medium· 5.4PoCMrDoc through 1.1.1 Missing Authorization via api/import_local_doc/ Endpoint
MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sort_…
▾ Twilightzmister2016 · MrDocEPSS 0.27%via CVEORG