Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: zmister2016 Clear all filters
TI-2026-83819 CVE-2026-120427 · GHSA-3j38-ccjp-5wfv

Missing authorization in MrDoc get_doctemp exposes other users' templates

Priority MEDIUM 57

MrDoc through 1.1.1 contains a missing authorization vulnerability in the get_doctemp view that allows authenticated users to read other users' document templates.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00251 Published 2026-11-02 No fix listed CWE-639
TI-2026-81167 CVE-2026-117563 · GHSA-rf24-chhw-3jch

Broken access control in MrDoc lets users alter other users' shares

Priority LOW 23

MrDoc through 1.1.1 contains a broken access control vulnerability in the manage_doc_share type 3 branch that allows authenticated users to modify other users' document share settings because updates lack an ownership ch…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00223 Published 2026-10-27 No fix listed CWE-639
TI-2026-75431 CVE-2026-111645 · GHSA-x63c-25rw-gwj4

Missing authorization in MrDoc allows editing other users' documents

Priority MEDIUM 57

MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00265 Published 2026-10-16 No fix listed CWE-639