CVE-2026-111364
High · CVSS 7.1Published 2026-10-15
CVSS
7.1
High
EPSS
—
exploit probability
Active Exploit
No
not yet listed
What is CVE-2026-111364?
MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to read documents from unauthorized books. Attackers holding a non-observer role on any book can name that book and iterate sequential document ids to read markdown and HTML from private books.
CVSS Score Explained
CVSS 7.1 is High severity. Exploitation is likely straightforward and the impact is significant — data loss, privilege escalation, or remote code execution are common outcomes. Patch as soon as possible.
EPSS Exploitation Probability
No EPSS score yet — model needs more data on this CVE.
References & Patches
- ›https://github.com/mindoc-org/mindoc
- ›https://github.com/mindoc-org/mindoc/blob/v2.2-beta.2/controllers/DocumentController.go#L847-L973
- ›https://github.com/mindoc-org/mindoc/blob/v2.2-beta.2/routers/router.go#L242
- ›https://hackmd.io/@hieuPenguinnn/mindoc-api-content-get-cross-book-document-idor
- ›https://www.vulncheck.com/advisories/mindoc-through-2.2-beta.2-idor-via-api-key-content-id-get-branch
Track vulnerabilities for your stack
Tell us what tech you run — Node.js, Python, Java, nginx, whatever — and get a weekly email when new CVEs affect it.
Recent CVEs
- CVE-2026-8311Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2026-5819Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2026-2937Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2026-107316Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2026-107172Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2025-3778Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—