CVE-2026-111645

MediumCVSS 5.4/10Last modified Oct 19, 2026

Description

MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sort_data document ids to publish private drafts and reparent documents, or POST with arbitrary top_doc ids to inject documents.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Oct 16, 2026
Last modified: Oct 19, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1116465.9SurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated attackers to download any stored file by CVE-2026-1116474.3PickMall lilishop through 5.0.0 contains an insecure direct object reference vulnerability that allows authenticated buyers to read other bu CVE-2026-1116482.7BuildAdmin through 2.3.9 contains an insecure direct object reference vulnerability that allows authenticated backend administrators to modi CVE-2026-1116496.5Rocboss paopao-ce through 0.6.0-alpha.3 contains an insecure direct object reference vulnerability in DownloadAttachment that allows authent CVE-2026-111659.6Use after free in WebMIDI in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape v CVE-2026-1116508.6ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated att CVE-2026-1116516.5Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module DownloadController that allo CVE-2026-1116525.3Engineercms through 2.0.5 contains a missing authorization vulnerability in AttachController.Attachment that allows unauthenticated attacker CVE-2026-1116535.353AIHub through 0.5.3 contains a missing authentication vulnerability that allows unauthenticated attackers to overwrite any enterprise's pr CVE-2026-1116546.3FastBee through 2.1.0 contains an insecure direct object reference vulnerability that allows authenticated low-privilege users to access oth CVE-2026-1116553.8ThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object reference vulnerability that allows non-super administrators CVE-2026-1116565.4ChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to access another tenant's