CVE-2026-111364 in MinDoc
Summary
by MITRE • 10/16/2026
MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to read documents from unauthorized books. Attackers holding a non-observer role on any book can name that book and iterate sequential document ids to read markdown and HTML from private books.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The MinDoc application, specifically through version 2.2-beta.2, suffers from an insecure direct object reference vulnerability within the DocumentController.Content endpoint. This flaw stems from a failure in server-side access control logic when handling requests for document content. The system relies on client-supplied identifiers to retrieve specific documents but fails to adequately verify that the requesting user possesses sufficient privileges not only for the individual document but also for the parent book or repository containing it. Consequently, an attacker who has authenticated into the application can manipulate these object references to access resources they are explicitly denied permission to view.
Technically, this vulnerability allows users with a non-observer role on any given book to bypass security restrictions by iterating through sequential document identifiers. By systematically guessing or enumerating document IDs associated with private books where they lack appropriate permissions, an attacker can successfully retrieve the underlying markdown and HTML content of those documents. The core issue lies in the absence of robust authorization checks that validate the relationship between the user's role within a specific book context and their request to access individual items within that book. This oversight enables unauthorized data exfiltration even when the overall application authentication mechanism functions correctly.
The operational impact of this vulnerability is significant, as it compromises the confidentiality of sensitive information stored in private books. Since MinDoc is often used for collaborative documentation where varying levels of access are granted to different team members, this flaw undermines the intended isolation between restricted and open resources. Attackers can extract proprietary code snippets, internal procedures, or confidential project details by exploiting the predictable nature of sequential document IDs. This leads to a direct breach of data integrity and confidentiality principles, potentially exposing intellectual property or sensitive organizational knowledge to unauthorized parties who hold minimal privileges elsewhere in the system.
To mitigate this vulnerability, developers must implement strict object-level authorization checks within the DocumentController.Content method. It is essential to verify that the authenticated user has explicit read permissions for both the specific document ID requested and the parent book container associated with it. Implementing random or non-sequential identifiers for documents can also reduce the effectiveness of enumeration attacks by making sequential guessing impractical. Furthermore, adopting a principle of least privilege ensures that users only have access to resources necessary for their role, while comprehensive logging should be enabled to detect unusual patterns of document access attempts indicative of ID iteration exploits.
This vulnerability aligns with CWE-284, which describes Improper Access Control, specifically highlighting failures in verifying user authorization against specific objects rather than just general roles. In the context of the MITRE ATT&CK framework, this behavior corresponds to T1078, Valid Accounts, as it leverages legitimate credentials to access unauthorized resources, and potentially T1119, Automated Collection, if used systematically to harvest data from multiple private repositories. Addressing these gaps requires a shift toward explicit authorization policies that validate every resource request against the user's specific permissions within the context of each individual object accessed.