MrDoc CVE-2026-111645

Requires a valid authenticated MrDoc account (PR:L) with access to the ImportLocalDoc API; the attacker must know or enumerate another user's document IDs (sort_data) or project top_doc IDs, which the API accepts without verifying object ownership. Exploitation works over the network against standard multi-user MrDoc installations with no victim interaction (UI:N) and no non-default configuration, but is limited to the application's authorization boundary: it affects only document/project data the attacker can reference, cannot escalate to the host, and depends on the deployment being multi-tenant (single-user instances have no cross-user victim).

This is a moderate-severity object-level authorization flaw (CWE-639 / IDOR) whose signals are internally consistent rather than alarming. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N) scores 5.3 and correctly reflects a network-reachable, low-complexity bug that nonetheless requires PR:L - i.e. an already-authenticated application account. There is no CISA KEV listing and the input provides no explicit POC flag, so exploitation status is 'no public exploit identified at time of analysis'; however, a detailed third-party technical writeup (hackmd) and a VulnCheck advisory with a direct source-code line reference exist, which materially lowers the research/reverse-engineering barrier even without packaged exploit code. No EPSS score was supplied, so widespread-automated-exploitation probability cannot be quantified from the data. Impact is bounded: C:L/I:L with A:N means an attacker can read/modify or reparent other users' documents and publish private drafts, but cannot destroy availability or gain system-level control. Net assessment: a legitimate data-integrity/confidentiality issue for multi-tenant MrDoc deployments, but not a drop-everything priority - the authentication prerequisite and limited, scope-unchanged impact keep real-world risk in the medium band. Key missing data to verify: EPSS, independent confirmation of a patched version, and whether any public PoC is embedded in the referenced writeup.

An attacker who holds any ordinary authenticated MrDoc account sends a crafted PUT request to the ImportLocalDoc API supplying sort_data document IDs belonging to another user, causing that victim's private drafts to be published and their documents reparented under attacker-controlled structure; a POST with arbitrary top_doc IDs can inject documents into another user's project. Because AC:L and UI:N, no victim interaction or special timing is needed - only a valid session. No packaged public exploit is confirmed, but a step-by-step technical writeup and the vulnerable source lines are publicly referenced.