CVE-2026-117563 MrDoc through 1.1.1 Broken Access Control via manage_doc_share

Medium 5.3 Published 27 Oct 2026 Updated 27 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-117563?

CVE-2026-117563 is a medium-severity vulnerability in zmister2016 MrDoc, published on 27 Oct 2026.

Official description

MrDoc through 1.1.1 contains a broken access control vulnerability in the manage_doc_share type 3 branch that allows authenticated users to modify other users' document share settings because updates lack an ownership check. Attackers can compute predictable share tokens from the MD5 of document ID and username to re-enable disabled shares or remove access codes, exposing private documents.

Weakness: CWE-639

Which versions are affected by CVE-2026-117563?

How do I fix CVE-2026-117563?

No fix has been published for CVE-2026-117563 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-117563 being exploited?

There is no known exploitation of CVE-2026-117563 in the wild and no public exploit code.

Sources

Also known as GHSA-rf24-chhw-3jch.