{"id":"CVE-2026-119661","kind":"vulnerability","aliases":["CVE-2026-119661"],"related":[],"title":"ShowDoc: authenticated users can delete other users' parameter entries","description":"ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry id. Authenticated attackers can place their own entry id first and append other users' entry ids to permanently delete those parameter-description entries.","summary":"ShowDoc checks edit permission only for the first entry id in a deleteEntries request, so a logged-in user can append other users' entry ids. Those parameter-description entries are permanently deleted.","severity":"medium","cvss":4.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-documentation","package","self-hosted","showdoc"],"not_affected_if":["single-user-instance","unauthenticated-only"],"how_to_check":"- Check the ShowDoc version in the deployed instance; the affected range is `through 3.9.5`.\n- Confirm whether the `api/paramDescLib/deleteEntries` endpoint is reachable by registered users.","fix":"- Move to a ShowDoc release newer than `3.9.5`; the sources do not name the fixed version.","status":"open","published_at":"2026-10-30T15:16:50+00:00","first_seen_at":"2026-10-30T15:31:10+00:00","triaged_at":"2026-10-30T15:33:53+00:00","updated_at":"2026-10-30T15:33:53+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T15:33:53Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a ShowDoc release newer than `3.9.5`; the sources do not name the fixed version.","reach":"internet","title":"ShowDoc: authenticated users can delete other users' parameter entries","impact":"medium","summary":"ShowDoc checks edit permission only for the first entry id in a deleteEntries request, so a logged-in user can append other users' entry ids. Those parameter-description entries are permanently deleted.","audience":"businesses","category":"package","nicknames":[],"who_cares":["showdoc","self-hosted","api-documentation"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Other users' parameter-description entries are permanently deleted","analyst_note":"Confirm the fixed ShowDoc version and whether hosted instances are affected; check the NVD entry for the exact CVSS vector.","how_to_check":"- Check the ShowDoc version in the deployed instance; the affected range is `through 3.9.5`.\n- Confirm whether the `api/paramDescLib/deleteEntries` endpoint is reachable by registered users.","plain_action":"","needs_analyst":true,"not_affected_if":["unauthenticated-only","single-user-instance"],"who_is_affected":"Teams that run a self-hosted ShowDoc instance with more than one user who can edit API documentation. Exposure requires an authenticated account; single-user or read-only instances are less exposed. The sources do not say whether hosted ShowDoc services are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000694,"input_tokens":4145,"output_tokens":559,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119661':12A,15A '-2026':11A,14A '3.9.5':60C 'api':17B 'api-document':16B 'api/paramdesclib/deleteentries':68C 'append':45B,91C 'attack':82C 'authent':2A,81C 'author':63C 'bypass':64C 'check':25B,71C 'contain':61C 'cve':10A,13A 'delet':5A,57B,98C 'deleteentri':36B 'descript':53B,102C 'document':18B 'edit':26B,72C 'endpoint':69C 'entri':9A,32B,48B,54B,79C,87C,94C,103C 'first':31B,77C,89C 'host':22B 'id':33B,49B,80C,88C,95C 'log':41B 'logged-in':40B 'packag':19B 'paramet':8A,52B,101C 'parameter-descript':51B,100C 'perman':56B,97C 'permiss':27B,73C 'place':84C 'request':37B 'self':21B 'self-host':20B 'showdoc':1A,23B,24B,58C 'suppli':78C 'user':3A,7A,43B,47B,93C 'vulner':65C","nicknames":[],"mitigations":[],"who_affected":"Teams that run a self-hosted ShowDoc instance with more than one user who can edit API documentation. Exposure requires an authenticated account; single-user or read-only instances are less exposed. The sources do not say whether hosted ShowDoc services are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T15:16:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119661","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119661","severity":null,"published_at":"2026-10-30T15:16:50+00:00","modified_at":"2026-10-30T15:16:50+00:00","first_seen_at":"2026-10-30T15:31:10+00:00","fetched_at":"2026-10-30T15:31:10+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}