Vulnerability Description
MrDoc through 1.1.1 contains a broken access control vulnerability in the manage_doc_share type 3 branch that allows authenticated users to modify other users' document share settings because updates lack an ownership check. Attackers can compute predictable share tokens from the MD5 of document ID and username to re-enable disabled shares or remove access codes, exposing private documents.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/zmister2016/MrDoc
- https://github.com/zmister2016/MrDoc/blob/v1.1.1/app_doc/views.py#L1835-L1849
- https://github.com/zmister2016/MrDoc/commit/2cd13ff0659dbef9aea59d5af122a2120494
- https://github.com/zmister2016/MrDoc/issues/208
- https://www.vulncheck.com/advisories/mrdoc-through-1.1.1-broken-access-control-v
FAQ
What is CVE-2026-117563?
CVE-2026-117563 is a vulnerability with a CVSS score of 5.4 (MEDIUM). MrDoc through 1.1.1 contains a broken access control vulnerability in the manage_doc_share type 3 branch that allows authenticated users to modify other users' document share settings because updates ...
How severe is CVE-2026-117563?
CVE-2026-117563 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-117563?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.