GCVE - cpe:2.3:a:mrdoc:mrdoc:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:mrdoc:mrdoc:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Mrdoc (`7c87b091-01ba-5b84-a22e-73a07d8d4776`)
Product	Mrdoc (`19bb4e51-0f33-5c03-af46-b05d5e0d4243`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/zmister2016/mrdoc`	purl2cpe	2026-06-01 10:17:50.242407

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-111645`	vulnerable	2026-11-03 10:16:11.642432	MrDoc through 1.1.1 Missing Authorization via api/import_local_doc/ Endpoint MEDIUM (5.4) MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sort_data document ids to publish private drafts and reparent documents, or POST with arbitrary top_doc ids to inject documents. Published: 2026-10-16T17:39:14.432Z Updated: 2026-10-19T13:13:46.523Z Open on db.gcve.eu Reference links https://hackmd.io/@hieuPenguinnn/mrdoc-import-local-doc-api-missing-authz-cross-user-publish https://github.com/zmister2016/MrDoc/blob/v1.1.1/app_doc/views_import.py#L165-L182 https://www.vulncheck.com/advisories/mrdoc-through-1.1.1-missing-authorization-via-api-import-local-doc-endpoint	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-117563`	vulnerable	2026-11-03 10:15:34.361046	MrDoc through 1.1.1 Broken Access Control via manage_doc_share MEDIUM (5.4) MrDoc through 1.1.1 contains a broken access control vulnerability in the manage_doc_share type 3 branch that allows authenticated users to modify other users' document share settings because updates lack an ownership check. Attackers can compute predictable share tokens from the MD5 of document ID and username to re-enable disabled shares or remove access codes, exposing private documents. Published: 2026-10-27T13:07:57.656Z Updated: 2026-11-02T19:15:30.217Z Open on db.gcve.eu Reference links https://github.com/zmister2016/MrDoc/issues/208 https://github.com/zmister2016/MrDoc https://github.com/zmister2016/MrDoc/commit/2cd13ff0659dbef9aea59d5af122a21204942262 https://github.com/zmister2016/MrDoc/blob/v1.1.1/app_doc/views.py#L1835-L1849 https://www.vulncheck.com/advisories/mrdoc-through-1.1.1-broken-access-control-via-manage-doc-share	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-45250`	vulnerable	2026-06-08 07:25:10.976619	Details available MrDoc v0.95 and before is vulnerable to Server-Side Request Forgery (SSRF) in the validate_url function of the app_doc/utils.py file. Published: 2025-05-06T00:00:00.000Z Updated: 2025-05-06T20:29:21.295Z Open on db.gcve.eu Reference links https://github.com/zmister2016/MrDoc https://github.com/Anike-x/CVE-2025-45250	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-32568`	vulnerable	2026-06-08 05:32:07.454193	Deserialization of Untrusted Data in zmister2016/mrdoc HIGH (7.5) mrdoc is vulnerable to Deserialization of Untrusted Data Published: 2021-09-06T11:17:15.000Z Updated: 2024-08-03T23:25:30.861Z Open on db.gcve.eu Reference links https://huntr.dev/bounties/04fc04b3-2dc1-4cad-a090-e403cd66b5ad https://github.com/zmister2016/mrdoc/commit/bb49e1287700b4e7681eab544c61093821ce72f6	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Mrdoc

Notes

PURL mappings

Vulnerability references

Contribute