Live › vulnerability › CVE-2026-117563
Go to dashboardMrDoc through 1.1.1 lets any logged-in user change the share settings of documents owned by other users, because the update path skips an ownership check. Share tokens are predictable MD5 hashes of the document ID and username, so an attacker can re-enable disabled shares or remove access codes and read private documents.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Self-hosted MrDoc instances at version 1.1.1 or earlier that have multiple user accounts with document sharing in use. A single-user instance or one where sharing is not used has little exposure from this flaw. The sources do not name a fixed version.
No product ranges from the sources yet.
1.1.1 and earlier are in the affected range per the description.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
MrDoc through 1.1.1 contains a broken access control vulnerability in the manage_doc_share type 3 branch that allows authenticated users to modify other users' document share settings because updates lack an ownership check. Attackers can compute predictable share tokens from the MD5 of document ID and username to re-enable disabled shares or remove access codes, exposing private documents.
This page as .md · .json · in your agent: get_signal("CVE-2026-117563")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.