---
id: "CVE-2026-117563"
kind: "vulnerability"
aliases: ["CVE-2026-117563"]
title: "MrDoc: authenticated users can alter other users' document share settings"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["django", "mrdoc", "package", "python", "self-hosted"]
not_affected_if: ["sharing-unused", "single-user"]
published_at: "2026-10-27T14:16:38+00:00"
first_seen_at: "2026-10-27T14:32:19+00:00"
updated_at: "2026-10-27T14:33:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117563", "first_seen_at": "2026-10-27T14:32:19+00:00"}]
---

# MrDoc: authenticated users can alter other users' document share settings

MrDoc through 1.1.1 lets any logged-in user change the share settings of documents owned by other users, because the update path skips an ownership check. Share tokens are predictable MD5 hashes of the document ID and username, so an attacker can re-enable disabled shares or remove access codes and read private documents.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed MrDoc version; `1.1.1` and earlier are in the affected range per the description.
- Review whether document sharing (type 3 share) is used on the instance.

## Timeline

- 2026-10-27T14:32:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117563

## From the sources

MrDoc through 1.1.1 contains a broken access control vulnerability in the manage_doc_share type 3 branch that allows authenticated users to modify other users' document share settings because updates lack an ownership check. Attackers can compute predictable share tokens from the MD5 of document ID and username to re-enable disabled shares or remove access codes, exposing private documents.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_