Live › vulnerability › CVE-2026-120427
MrDoc, a self-hosted documentation wiki, has a missing authorization check in its get_doctemp view. An authenticated user can enumerate sequential doctemp_id values to read the private document templates of every user on the instance.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
Teams running MrDoc 1.1.1 or earlier where more than one person has an account, since any logged-in user can request other users' templates by ID. Instances used by a single trusted user, or with no open registration, are much less exposed. The sources do not say whether the flaw depends on a non-default setting.
No product ranges from the sources yet.
1.1.1 range named in the advisory1.1.1 (the patched version is not named in the sources; see the linked patch and release notes)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
MrDoc through 1.1.1 contains a missing authorization vulnerability in the get_doctemp view that allows authenticated users to read other users' document templates. Attackers can enumerate the sequential doctemp_id POST parameter to retrieve the private template content of every user on the instance.
This page as .md · .json · in your agent: get_signal("CVE-2026-120427")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.