Mrdoc
Monthly
MrDoc through 1.1.1 allows any authenticated user to read other users' private document templates by submitting sequential doctemp_id values to the get_doctemp view, whose database lookup lacks an owner constraint. The flaw is a CWE-639 object-level authorization bypass affecting confidentiality only (CVSS 4.0 score 5.3, PR:L); template contents can be read but not modified or deleted. No public exploit code was identified at time of analysis, and an upstream vendor fix commit is available.
Authenticated users of MrDoc through 1.1.1 can re-enable disabled document shares and strip access codes from other users' shares, because the manage_doc_share type 3 branch updates DocShare records filtered only on the share token with no ownership check. The token itself is the enabling weakness: it is computed as the MD5 of '{doc_id}_{username}', so anyone who knows or can enumerate the document ID and the owner's username can derive a valid token offline and use it to flip is_enable to true or set share_type to 0, exposing documents that were meant to be private. Severity is medium (CVSS 4.0 base 5.3, assessed 3.1 5.3, CWE-639), exploitation requires a valid account plus a pre-existing share record on the target document, and no public exploit has been identified at time of analysis.
Missing object-level authorization in MrDoc through 1.1.1 lets any authenticated user publish other users' private drafts, reparent their documents, and inject documents into projects they do not own by supplying arbitrary document or project identifiers to the ImportLocalDoc API. The flaw is a classic insecure direct object reference (CWE-639) assessed at 5.3 (CVSS:4.0 AV:N/AC:L/PR:L/UI:N, low confidentiality and integrity impact) and is confined to the application's own authorization boundary: it cannot reach the host, and it requires a multi-user deployment in which a victim's document or project actually exists. No public exploit code was identified at time of analysis and the CVE is not listed in CISA KEV, though a public technical writeup documents the endpoint's behavior.
MrDoc v0.95 and before is vulnerable to Server-Side Request Forgery (SSRF) in the validate_url function of the app_doc/utils.py file. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
mrdoc is vulnerable to Deserialization of Untrusted Data. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
MrDoc through 1.1.1 allows any authenticated user to read other users' private document templates by submitting sequential doctemp_id values to the get_doctemp view, whose database lookup lacks an owner constraint. The flaw is a CWE-639 object-level authorization bypass affecting confidentiality only (CVSS 4.0 score 5.3, PR:L); template contents can be read but not modified or deleted. No public exploit code was identified at time of analysis, and an upstream vendor fix commit is available.
Authenticated users of MrDoc through 1.1.1 can re-enable disabled document shares and strip access codes from other users' shares, because the manage_doc_share type 3 branch updates DocShare records filtered only on the share token with no ownership check. The token itself is the enabling weakness: it is computed as the MD5 of '{doc_id}_{username}', so anyone who knows or can enumerate the document ID and the owner's username can derive a valid token offline and use it to flip is_enable to true or set share_type to 0, exposing documents that were meant to be private. Severity is medium (CVSS 4.0 base 5.3, assessed 3.1 5.3, CWE-639), exploitation requires a valid account plus a pre-existing share record on the target document, and no public exploit has been identified at time of analysis.
Missing object-level authorization in MrDoc through 1.1.1 lets any authenticated user publish other users' private drafts, reparent their documents, and inject documents into projects they do not own by supplying arbitrary document or project identifiers to the ImportLocalDoc API. The flaw is a classic insecure direct object reference (CWE-639) assessed at 5.3 (CVSS:4.0 AV:N/AC:L/PR:L/UI:N, low confidentiality and integrity impact) and is confined to the application's own authorization boundary: it cannot reach the host, and it requires a multi-user deployment in which a victim's document or project actually exists. No public exploit code was identified at time of analysis and the CVE is not listed in CISA KEV, though a public technical writeup documents the endpoint's behavior.
MrDoc v0.95 and before is vulnerable to Server-Side Request Forgery (SSRF) in the validate_url function of the app_doc/utils.py file. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
mrdoc is vulnerable to Deserialization of Untrusted Data. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.