CVE-2026-125375 · Other
NO FIX YET
MrDoc, a self-hosted documentation wiki, does not check ownership in its document sorting handlers. A registered user can supply arbitrary document IDs to move other users' documents or set them to draft or removed, hiding published content.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run MrDoc with multiple registered users who can create or own projects are exposed, since any such user can alter documents they do not own. Single-user or read-only instances have less exposure. The sources do not name a fixed version, though a patch link is listed.
Not affected if single-user-instance
Who cares django, mrdoc, python, self-hosted
1.1.1 or earlier, as the sources say the flaw runs through 1.1.1.project_doc_sort and manage_project_doc_sort handlers in the MrDoc source code.No fix yet, per the sources.
MrDoc through 1.1.1 contains a missing authorization vulnerability in the project_doc_sort and manage_project_doc_sort handlers that allows registered users to modify other users' documents by supplying arbitrary document IDs in sort_data. Attackers owning any project can reparent and reorder documents by sequential ID and set their status to draft or removed, hiding published documents.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.