MinDoc EUVD-2026-102504

The attacker must be an authenticated MinDoc user holding at least a non-observer role (e.g., editor) on any one book in the instance; a pure observer or fully unauthenticated user cannot exploit it. Given such access, exploitation requires only naming a target private book and iterating sequential, predictable document IDs against DocumentController.Content - no further configuration is needed. Limiting factors: exploitation is bounded by the need for a valid low-privileged account (risk rises sharply where self-registration is enabled or many low-trust collaborators exist) and is read-only, exposing document markdown/HTML without granting write, integrity, or availability impact.

This is an authenticated insecure direct object reference (IDOR / CWE-639) in MinDoc's DocumentController.Content endpoint. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) is internally consistent with the description: network-reachable, low attack complexity, requires low privileges (PR:L - the attacker must already hold a non-observer role on at least one book), no user interaction, and a high confidentiality impact with no integrity or availability impact. The 7.1 score is driven purely by data exposure, not system compromise. No EPSS score, CISA KEV entry, or explicit POC flag was supplied in the input; absence of EPSS/KEV data means widespread automated exploitation cannot be confirmed from these signals. One reference (the hackmd writeup) documents the exact technique in detail, which lowers the barrier to reproduction even though no packaged exploit code is flagged. Net: a genuine but moderate-priority authorization flaw - real and easily reproducible by any authenticated collaborator, but gated behind requiring a valid non-observer account and limited to read-only confidentiality disclosure, so it is not a drop-everything unauthenticated RCE. Prioritize for instances with open registration or many low-trust collaborators; deprioritize for tightly controlled single-tenant deployments.

An attacker registers or is granted a non-observer role (e.g., editor) on any single book in a shared MinDoc instance. They then call the Content API naming a different, private book they have no access to and iterate through sequential document IDs, harvesting the markdown and rendered HTML of confidential documents. A detailed public technical writeup of the method exists (hackmd), making reproduction straightforward, though no packaged exploit tool is flagged in the input.