Threats tagged 'ghsa-gg5q-799f-w9j8'

MrDoc versions through 1.1.1 have a missing authorization vulnerability in the project_doc_sort and manage_project_doc_sort handlers. This flaw allows registered users to modify documents owned by other users by supplying arbitrary document IDs in sort_data. Attackers with access to any project can reorder and reparent documents by sequential ID and change their status to draft or removed, effectively hiding published documents.