Threats affecting pkg:github/zmister2016/MrDoc

MrDoc versions up to 1.1.1 have a broken access control vulnerability that allows authenticated users to modify document share settings of other users. This occurs because the application does not verify ownership when updating share settings. Attackers can predict share tokens by computing the MD5 hash of the document ID and username, enabling them to re-enable disabled shares or remove access codes, potentially exposing private documents.

MrDoc versions up to 1.1.1 have a missing object-level authorization vulnerability in the ImportLocalDoc API. Authenticated users can exploit this flaw to modify other users' documents and projects by sending crafted PUT or POST requests. This allows publishing private drafts, reparenting documents, or injecting documents without proper authorization.