CVE-2026-119661 Details
Description
ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry id. Authenticated attackers can place their own entry id first and append other users' entry ids to permanently delete those parameter-description entries.
A vulnerability allowing authorization bypass has been identified in ShowDoc versions through 3.9.5. The issue resides in the 'api/paramDescLib/deleteEntries' endpoint, where the authorization check for edit permissions is only applied to the first entry ID in the provided list. This flaw enables authenticated attackers to manipulate the request by placing their own entry ID first and appending additional IDs from other users to delete those entries permanently. The vulnerability exploits a trust boundary between different users and their projects, leading to unauthorized deletions.
The vulnerability has been fixed in ShowDoc version 3.9.6. Users should update to this version to address the authorization bypass issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/star7th/showdoc | [email protected] | Vendor |
| https://github.com/star7th/showdoc/blob/v3.9.5/server/app/Api/Controller/ParamDescLibController.php#L545-L584 | [email protected] | Source CodeVendor |
| https://github.com/star7th/showdoc/commit/53228511e656904abf7841c3d25ff78a4b5ce9c2 | [email protected] | Source CodeVendor |
| https://github.com/star7th/showdoc/issues/2612 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://hackmd.io/@hieuPenguinnn/showdoc-paramdesclib-cross-item-idor-delete | [email protected] | ExploitTechnical Analysis |
| https://www.vulncheck.com/advisories/showdoc-through-3.9.5-authorization-bypass-via-paramdesclib-deleteentries | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ShowDoc | <= 3.9.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |