MrDoc CVE-2026-120427

Requires a valid authenticated session on the target MrDoc instance (CVSS PR:L); it is not remote-unauthenticated. The attacker sends a POST to the get_doctemp view supplying the doctemp_id parameter, which in MrDoc through 1.1.1 was resolved with DocTemp.objects.get(id=...) without a create_user ownership check, so any logged-in user can read any template. Sequential integer doctemp_id values make full enumeration of all users' templates trivial, and no user interaction is needed (UI:N). Limiting factors: an account is required, so exposure scales with whether the instance permits open self-registration versus admin-provisioned accounts; impact is confined to reading template content (no modification or deletion), affecting confidentiality only.

Signals are consistent and point to a moderate, not urgent, issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 5.3 medium score agree with the description: exploitation is network-based and low-complexity but requires an authenticated account (PR:L), and the only impact is confidentiality of document-template content (VC:L, with VI/VA:N). The vuln.today Decision label is 'this_month' - a scheduled-patch priority, not act_now or emergency. This is not in CISA KEV (no confirmed active exploitation) and no EPSS score was provided, so widespread-exploitation probability cannot be quantified from the input. A public technical write-up (hackmd) and a VulnCheck advisory exist and the fix commit is public, which makes the flaw easy to understand and reproduce, but the input does not mark any PoC as confirmed working exploit code. Net: a genuine broken-object-level-authorization (IDOR) bug worth patching this cycle, but the authentication requirement and confidentiality-only, limited-scope impact keep it below high-priority emergency handling. Missing data to note explicitly: no EPSS score and no KEV entry were supplied, so real-world exploitation volume is unknown.

An attacker who holds any valid account on a MrDoc instance (including a self-registered one, where registration is open) sends POST requests to the get_doctemp view, incrementing the sequential doctemp_id parameter. Because the view fetched the template by id alone without verifying ownership, each request returns another user's private template content, letting the attacker harvest every template on the instance. A public write-up describing the flaw exists; it is not verified as working exploit code.