Live › vulnerability › CVE-2026-119661
ShowDoc checks edit permission only for the first entry id in a deleteEntries request, so a logged-in user can append other users' entry ids. Those parameter-description entries are permanently deleted.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 15:31 UTC. All times on this page are UTC.
Teams that run a self-hosted ShowDoc instance with more than one user who can edit API documentation. Exposure requires an authenticated account; single-user or read-only instances are less exposed. The sources do not say whether hosted ShowDoc services are affected.
No product ranges from the sources yet.
through 3.9.5.api/paramDescLib/deleteEntries endpoint is reachable by registered users.3.9.5; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry id. Authenticated attackers can place their own entry id first and append other users' entry ids to permanently delete those parameter-description entries.
This page as .md · .json · in your agent: get_signal("CVE-2026-119661")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.