CVE-2026-111645 Details

A missing object-level authorization vulnerability has been identified in the MrDoc application, specifically in versions through 1.1.1. This vulnerability exists within the ImportLocalDoc API, where authenticated users can manipulate documents and projects belonging to other users. The issue arises because the API lacks proper authorization checks, allowing users to send PUT requests with arbitrary document IDs to publish private drafts and reparent documents. Additionally, users can use POST requests with specified project IDs to inject documents into those projects.

The vulnerability can be addressed by implementing object-level authorization checks in the ImportLocalDoc API. This involves verifying that the user has the right to modify the specified documents or projects before allowing any changes. Additionally, updating the application's permission settings to ensure that only authenticated users with the appropriate rights can access sensitive endpoints would enhance security.