Read the docs
TI-2026-83135 Aliases CVE-2026-119661GHSA-2x8q-m4r9-vg7h

Authorization bypass in ShowDoc paramDescLib deleteEntries

Priority LOW 12CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

ShowDoc through 3.9.5 contains an authorization bypass in the api/paramDescLib/deleteEntries endpoint, which checks edit permission only for the first supplied entry id (CWE-639). An authenticated attacker can place their own entry id first, append other users' entry ids, and permanently delete those parameter-description entries.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry id. Authenticated attackers can place their own entry id first and append other users' entry ids to permanently delete those parameter-description entries.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00379 32nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
star7thShowDocup to 3.9.5—No fix listedCNA
  • ShowDoc Vendorstar7th Affected up to 3.9.5 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for ShowDoc.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-119661
  2. 2026-10-30 CISA SSVC decision points changed
  3. 2026-10-30 Alias added: GHSA-2x8q-m4r9-vg7h

References

Patch 1

Advisory 1

Other 3

  • TI-2025-00432 ShowDoc < 2.8.7 Unauthenticated File Upload Remote Code Execution CVSS 4.0CRITICAL 9.4
  • TI-2026-59246 star7th showdoc API Page Save Endpoint editormd.js cross site scripting CVSS 4.0MEDIUM 5.1
  • TI-2021-14768 Unrestricted File Upload in ShowDoc v2.9.5 allows remote attackers to execute arbitrary… CVSS 3.1CRITICAL 9.8
  • TI-2022-00287 SQL Injection in star7th/showdoc CVSS 3.1CRITICAL 9.8
  • TI-2021-18398 ShowDoc 2.8.3 ihas a file upload vulnerability, where attackers can use the vulnerability to obtain server permissions. CVSS 3.1CRITICAL 9.8
  • TI-2026-83553 Code injection in ShowDoc Mock templates lets users run commands CVSS 4.0HIGH 8.7
See all 45 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences