ShowDoc CVE-2026-119661

Requires an authenticated ShowDoc account holding edit permission on at least one parameter-description library (PR:L), used to supply a legitimately-owned entry id as the first element of the deleteEntries id list. The specific trigger per the source code: api/paramDescLib/deleteEntries (ParamDescLibController) called ParameterDescriptionEntry::findById on $ids[0] only and ran checkItemEdit against that single entry's item_id, then deleted the entire $ids array - so appending victim entry ids after a valid owned id bypasses the per-item check. Limiting factors: exploitation is not possible pre-authentication, impact is restricted to deletion of parameter-description entries (no read/confidentiality impact), and the attacker must know or enumerate the target entry ids. Affected: ShowDoc through 3.9.5; the linked vendor commit is the fix.

This is a genuinely low-priority issue, and the signals are internally consistent rather than conflicting. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L) and the 2.3 base score both point to low real-world severity: exploitation requires an authenticated account (PR:L) that already holds edit permission on at least one parameter-description library, and the impact is confined to integrity and availability of parameter-description entries (VI:L/VA:L) with no confidentiality exposure (VC:N) and no scope change (SC/SI/SA:N). The vuln.today decision label is 'monitor', the lowest urgency tier, which aligns with the low CVSS. There is no CISA KEV listing and no EPSS score was supplied, so there is no evidence of active or probable widespread exploitation. A public technical write-up (hackmd) and the upstream issue describe the flaw, but the input does not confirm working weaponized exploit code. The only mild tension is that the flaw is trivially understood and the fix is a simple per-entry permission check - so weaponization is easy if an attacker is motivated - but the pre-authentication barrier, the narrow data-only impact, and the niche product footprint keep real-world risk low. No key CVSS data is missing; the 4.0 vector is complete and consistent with the description.

An authenticated ShowDoc user with edit rights to any one parameter-description library crafts a batch delete request to api/paramDescLib/deleteEntries, placing one of their own entry ids first and appending entry ids belonging to other users' projects. Because the server validated edit permission only against the first id, all listed entries - including those the attacker has no rights to - are permanently deleted. A public PoC reference exists describing this exact cross-item IDOR; it is not verified as working exploit code.