Live › vulnerability › CVE-2026-111645
Go to dashboardMrDoc through 1.1.1 has a missing object-level authorization check in its ImportLocalDoc API. An authenticated user can send PUT requests with arbitrary document ids to publish other users' private drafts and move documents, or POST with arbitrary top_doc ids to inject documents into other users' projects.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run MrDoc 1.1.1 or earlier with user accounts that are not fully trusted. The exposure requires an authenticated account, so single-user or fully trusted internal instances carry less risk. unknown for whether other MrDoc builds are affected.
No product ranges from the sources yet.
unknown for the exact command; the sources do not say how it is deployed)1.1.1; the sources do not name the fixed releaseEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sort_data document ids to publish private drafts and reparent documents, or POST with arbitrary top_doc ids to inject documents.
This page as .md · .json · in your agent: get_signal("CVE-2026-111645")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.