---
id: "CVE-2026-119661"
kind: "vulnerability"
aliases: ["CVE-2026-119661"]
title: "ShowDoc: authenticated users can delete other users' parameter entries"
severity: "medium"
cvss: 4.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["api-documentation", "package", "self-hosted", "showdoc"]
not_affected_if: ["single-user-instance", "unauthenticated-only"]
published_at: "2026-10-30T15:16:50+00:00"
first_seen_at: "2026-10-30T15:31:10+00:00"
updated_at: "2026-10-30T15:33:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119661", "first_seen_at": "2026-10-30T15:31:10+00:00"}]
---

# ShowDoc: authenticated users can delete other users' parameter entries

ShowDoc checks edit permission only for the first entry id in a deleteEntries request, so a logged-in user can append other users' entry ids. Those parameter-description entries are permanently deleted.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the ShowDoc version in the deployed instance; the affected range is `through 3.9.5`.
- Confirm whether the `api/paramDescLib/deleteEntries` endpoint is reachable by registered users.

## Fix

- Move to a ShowDoc release newer than `3.9.5`; the sources do not name the fixed version.

## Timeline

- 2026-10-30T15:31:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119661

## From the sources

ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry id. Authenticated attackers can place their own entry id first and append other users' entry ids to permanently delete those parameter-description entries.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_