CVE-2026-111645 MrDoc through 1.1.1 Missing Authorization via api/import_local_doc/ Endpoint
Authenticated users can modify other users' documents and projects due to missing object-level authorization in the ImportLocalDoc API.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-111645?
CVE-2026-111645 is a medium-severity missing authorization vulnerability in zmister2016 MrDoc, published on 16 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sort_data document ids to publish private drafts and reparent documents, or POST with arbitrary top_doc ids to inject documents.
Weakness: CWE-639
Which versions are affected by CVE-2026-111645?
How do I fix CVE-2026-111645?
No fix has been published for CVE-2026-111645 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-111645 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-111645 exists.
Sources
Also known as GHSA-x63c-25rw-gwj4.