{"id":"CVE-2026-111645","kind":"vulnerability","aliases":["CVE-2026-111645"],"related":[],"title":"MrDoc: ImportLocalDoc API lets users modify others' documents and projects","description":"MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sort_data document ids to publish private drafts and reparent documents, or POST with arbitrary top_doc ids to inject documents.","summary":"MrDoc through 1.1.1 has a missing object-level authorization check in its ImportLocalDoc API. An authenticated user can send PUT requests with arbitrary document ids to publish other users' private drafts and move documents, or POST with arbitrary top_doc ids to inject documents into other users' projects.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["documentation","mrdoc","package","self-hosted"],"not_affected_if":["auth-required","single-trusted-user"],"how_to_check":"- Check the installed MrDoc version (`unknown` for the exact command; the sources do not say how it is deployed)\n- Look for the ImportLocalDoc API endpoint in the deployed MrDoc code and confirm whether it is reachable by regular accounts","fix":"- Upgrade MrDoc to a version later than `1.1.1`; the sources do not name the fixed release\n- Until patched, restrict access to the ImportLocalDoc API or disable user self-registration","status":"open","published_at":"2026-10-16T18:17:45+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T04:18:24+00:00","updated_at":"2026-10-25T04:18:24+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:18:24Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade MrDoc to a version later than `1.1.1`; the sources do not name the fixed release\n- Until patched, restrict access to the ImportLocalDoc API or disable user self-registration","reach":"network","title":"MrDoc: ImportLocalDoc API lets users modify others' documents and projects","impact":"medium","summary":"MrDoc through 1.1.1 has a missing object-level authorization check in its ImportLocalDoc API. An authenticated user can send PUT requests with arbitrary document ids to publish other users' private drafts and move documents, or POST with arbitrary top_doc ids to inject documents into other users' projects.","category":"package","nicknames":[],"who_cares":["mrdoc","self-hosted","documentation"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker modifies and publishes other users' private documents","analyst_note":"Confirm the fixed MrDoc version and whether a patch or advisory exists at the NVD entry or the MrDoc repository.","how_to_check":"- Check the installed MrDoc version (`unknown` for the exact command; the sources do not say how it is deployed)\n- Look for the ImportLocalDoc API endpoint in the deployed MrDoc code and confirm whether it is reachable by regular accounts","needs_analyst":true,"not_affected_if":["auth-required","single-trusted-user"],"who_is_affected":"Teams that run MrDoc 1.1.1 or earlier with user accounts that are not fully trusted. The exposure requires an authenticated account, so single-user or fully trusted internal instances carry less risk. unknown for whether other MrDoc builds are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000642,"input_tokens":3343,"output_tokens":615,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111645':13A,16A '-2026':12A,15A '1.1.1':25B,74C 'allow':88C 'api':3A,37B,86C 'arbitrari':46B,61B,104C,119C 'attack':98C 'authent':39B,89C 'author':32B,81C 'check':33B 'contain':75C 'cve':11A,14A 'data':106C 'doc':63B,121C 'document':8A,17B,47B,57B,67B,95C,107C,115C,125C 'draft':54B,112C 'host':22B 'id':48B,64B,108C,122C 'importlocaldoc':2A,36B,85C 'inject':66B,124C 'let':4A 'level':31B,80C 'miss':28B,77C 'modifi':6A,92C 'move':56B 'mrdoc':1A,18B,23B,72C 'object':30B,79C 'object-level':29B,78C 'other':7A 'packag':19B 'post':59B,117C 'privat':53B,111C 'project':10A,71B,97C 'publish':50B,110C 'put':43B,101C 'repar':114C 'request':44B,102C 'self':21B 'self-host':20B 'send':42B,100C 'sort':105C 'top':62B,120C 'user':5A,40B,52B,70B,90C,94C 'vulner':82C","nicknames":[],"mitigations":[],"who_affected":"Teams that run MrDoc 1.1.1 or earlier with user accounts that are not fully trusted. The exposure requires an authenticated account, so single-user or fully trusted internal instances carry less risk. unknown for whether other MrDoc builds are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:45+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111645","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111645","severity":null,"published_at":"2026-10-16T18:17:45+00:00","modified_at":"2026-10-19T14:16:58+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}