Threats tagged 'ghsa-x63c-25rw-gwj4'

1 threat

Threats tagged 'ghsa-x63c-25rw-gwj4'
Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	5.3	EPSS 0.2%	CVE-2026-111645MrDoc · Authorization Bypass Through User-Controlled Key Medium5.3EPSS 0.2%2026-10-16CVE Database V5CVE-2026-111645 MrDoc versions up to 1.1.1 have a missing object-level authorization vulnerability in the ImportLocalDoc API. Authenticated users can exploit this flaw to modify other users' documents and projects by sending crafted PUT or POST requests. This allows publishing private drafts, reparenting documents, or injecting documents without proper authorization. EPSS 0.2%Vulnerability zmister2016 #ghsa-x63c-25rw-gwj4	CVE Database V5	2026-10-16

Showing 1–1 of 1 result