[ CVE-2026-117563 · Published 27 Oct 2026 ]
Vulnerability in zmister2016 MrDoc
CVSS 5.4
EPSS <1%No fix listed yet
[ Description ]Official description
MrDoc through 1.1.1 contains a broken access control vulnerability in the manage_doc_share type 3 branch that allows authenticated users to modify other users' document share settings because updates lack an ownership check. Attackers can compute predictable share tokens from the MD5 of document ID and username to re-enable disabled shares or remove access codes, exposing private documents.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.