{"id":"CVE-2026-117563","kind":"vulnerability","aliases":["CVE-2026-117563"],"related":[],"title":"MrDoc: authenticated users can alter other users' document share settings","description":"MrDoc through 1.1.1 contains a broken access control vulnerability in the manage_doc_share type 3 branch that allows authenticated users to modify other users' document share settings because updates lack an ownership check. Attackers can compute predictable share tokens from the MD5 of document ID and username to re-enable disabled shares or remove access codes, exposing private documents.","summary":"MrDoc through 1.1.1 lets any logged-in user change the share settings of documents owned by other users, because the update path skips an ownership check. Share tokens are predictable MD5 hashes of the document ID and username, so an attacker can re-enable disabled shares or remove access codes and read private documents.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["django","mrdoc","package","python","self-hosted"],"not_affected_if":["sharing-unused","single-user"],"how_to_check":"- Check the installed MrDoc version; `1.1.1` and earlier are in the affected range per the description.\n- Review whether document sharing (type 3 share) is used on the instance.","fix":null,"status":"open","published_at":"2026-10-27T14:16:38+00:00","first_seen_at":"2026-10-27T14:32:19+00:00","triaged_at":"2026-10-27T14:33:10+00:00","updated_at":"2026-10-27T14:33:10+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T14:33:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"MrDoc: authenticated users can alter other users' document share settings","impact":"medium","summary":"MrDoc through 1.1.1 lets any logged-in user change the share settings of documents owned by other users, because the update path skips an ownership check. Share tokens are predictable MD5 hashes of the document ID and username, so an attacker can re-enable disabled shares or remove access codes and read private documents.","category":"package","nicknames":[],"who_cares":["mrdoc","self-hosted","python","django"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker reads other users' private documents via re-enabled shares.","analyst_note":"Fixed version and whether the 1.1.1 range has a patch are not in the sources; check the MrDoc repository or the NVD entry for a fixed release.","how_to_check":"- Check the installed MrDoc version; `1.1.1` and earlier are in the affected range per the description.\n- Review whether document sharing (type 3 share) is used on the instance.","needs_analyst":true,"not_affected_if":["single-user","sharing-unused"],"who_is_affected":"Self-hosted MrDoc instances at version 1.1.1 or earlier that have multiple user accounts with document sharing in use. A single-user instance or one where sharing is not used has little exposure from this flaw. The sources do not name a fixed version.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000593,"input_tokens":3343,"output_tokens":518,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-117563':13A,16A '-2026':12A,15A '1.1.1':26B,82C '3':95C 'access':74B,86C,136C 'allow':98C 'alter':5A 'attack':65B,114C 'authent':2A,99C 'branch':96C 'broken':85C 'chang':33B 'check':50B,113C 'code':75B,137C 'comput':116C 'contain':83C 'control':87C 'cve':11A,14A 'disabl':70B,132C 'django':17B 'doc':92C 'document':8A,38B,59B,79B,105C,124C,140C 'enabl':69B,131C 'expos':138C 'hash':56B 'host':23B 'id':60B,125C 'lack':110C 'let':27B 'log':30B 'logged-in':29B 'manag':91C 'md5':55B,122C 'modifi':102C 'mrdoc':1A,18B,24B,80C 'own':39B 'ownership':49B,112C 'packag':19B 'path':46B 'predict':54B,117C 'privat':78B,139C 'python':20B 're':68B,130C 're-en':67B,129C 'read':77B 'remov':73B,135C 'self':22B 'self-host':21B 'set':10A,36B,107C 'share':9A,35B,51B,71B,93C,106C,118C,133C 'skip':47B 'token':52B,119C 'type':94C 'updat':45B,109C 'user':3A,7A,32B,42B,100C,104C 'usernam':62B,127C 'vulner':88C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted MrDoc instances at version 1.1.1 or earlier that have multiple user accounts with document sharing in use. A single-user instance or one where sharing is not used has little exposure from this flaw. The sources do not name a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117563","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117563","severity":null,"published_at":"2026-10-27T14:16:38+00:00","modified_at":"2026-10-27T14:16:38+00:00","first_seen_at":"2026-10-27T14:32:19+00:00","fetched_at":"2026-10-27T14:32:19+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}