---
id: "CVE-2026-111645"
kind: "vulnerability"
aliases: ["CVE-2026-111645"]
title: "MrDoc: ImportLocalDoc API lets users modify others' documents and projects"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["documentation", "mrdoc", "package", "self-hosted"]
not_affected_if: ["auth-required", "single-trusted-user"]
published_at: "2026-10-16T18:17:45+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T04:18:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111645", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# MrDoc: ImportLocalDoc API lets users modify others' documents and projects

MrDoc through 1.1.1 has a missing object-level authorization check in its ImportLocalDoc API. An authenticated user can send PUT requests with arbitrary document ids to publish other users' private drafts and move documents, or POST with arbitrary top_doc ids to inject documents into other users' projects.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed MrDoc version (`unknown` for the exact command; the sources do not say how it is deployed)
- Look for the ImportLocalDoc API endpoint in the deployed MrDoc code and confirm whether it is reachable by regular accounts

## Fix

- Upgrade MrDoc to a version later than `1.1.1`; the sources do not name the fixed release
- Until patched, restrict access to the ImportLocalDoc API or disable user self-registration

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111645

## From the sources

MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sort_data document ids to publish private drafts and reparent documents, or POST with arbitrary top_doc ids to inject documents.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_