zmister2016 mrdoc vulnerabilities, newest first

By year: all 2026 2025 2024 2023 2022 2021

1. 5.3CVE-2026-125375EPSS 0.3%2026-11-10

   MrDoc through 1.1.1 contains a missing authorization vulnerability in the project_doc_sort and manage_project_doc_sort handlers that allows registered users to modify other users' documents by supplying arbitrary document IDs in sort_data.…

2. 5.3CVE-2026-120427EPSS 0.3%2026-11-02

   MrDoc through 1.1.1 contains a missing authorization vulnerability in the get_doctemp view that allows authenticated users to read other users' document templates. Attackers can enumerate the sequential doctemp_id POST parameter to retriev…

3. 5.3CVE-2026-117563EPSS 0.2%2026-10-27

   MrDoc through 1.1.1 contains a broken access control vulnerability in the manage_doc_share type 3 branch that allows authenticated users to modify other users' document share settings because updates lack an ownership check. Attackers can …

4. 5.3CVE-2026-111645EPSS 0.3%2026-10-16

   MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sort_da…