CVE-2026-117563 in MrDoc
Summary
by MITRE • 10/27/2026
MrDoc through 1.1.1 contains a broken access control vulnerability in the manage_doc_share type 3 branch that allows authenticated users to modify other users' document share settings because updates lack an ownership check. Attackers can compute predictable share tokens from the MD5 of document ID and username to re-enable disabled shares or remove access codes, exposing private documents.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in MrDoc versions up to 1.1.1 represents a critical failure in server-side access control mechanisms, specifically within the functionality responsible for managing document sharing permissions. This flaw is categorized under CWE-284 Improper Access Control and aligns with MITRE ATT&CK technique T1078 Valid Accounts, as it requires an authenticated user to exploit the system. The core technical issue resides in the logic handling share type 3 operations within the manage_doc_share module. When a user attempts to modify sharing settings for a document, the application fails to verify that the requesting user is the actual owner or has explicit administrative privileges over that specific resource. This absence of an ownership check means that any authenticated individual can submit requests targeting documents they do not own, and the server will process these modifications without validation.
The operational impact of this vulnerability is severe because it allows for unauthorized modification of document access controls. Specifically, attackers can manipulate share tokens which are generated using a predictable algorithm based on the MD5 hash of the document ID combined with the username. Because the token generation method lacks sufficient entropy or randomness beyond these static inputs, an attacker who knows the target user's name and the document identifier can compute valid share tokens for documents they do not have access to. This predictability enables two primary malicious actions: re-enabling shares that were previously disabled by the owner, thereby restoring public or semi-public access to private content, and removing existing access codes that protect sensitive information.
This capability effectively bypasses intended privacy boundaries within the MrDoc platform. Documents marked as private or restricted with specific passwords can be exposed to unauthorized parties simply because an attacker can generate a valid token that grants them entry. The use of MD5 for generating these tokens further exacerbates the risk, as MD5 is cryptographically broken and susceptible to collision attacks, although in this context, its primary weakness lies in the predictability derived from known inputs rather than pre-image resistance issues alone. Consequently, confidential documents shared within an organization or between individuals can be leaked without any direct breach of authentication credentials for those specific files.
Mitigation strategies must address both the immediate logical flaw and the underlying cryptographic weaknesses. The most critical remediation step is to implement strict server-side ownership verification in all endpoints related to document sharing modifications. Every request that alters share settings must validate that the authenticated user's identity matches the owner of the target resource or possesses a higher-level administrative role with explicit permission to manage that specific item. Additionally, the token generation mechanism should be overhauled to use cryptographically secure random number generators rather than deterministic hashes like MD5 based on predictable inputs. Implementing unique, high-entropy tokens for each share configuration would prevent attackers from computing valid access credentials without prior knowledge of the secret value generated by the server.
Beyond immediate code fixes, organizations deploying MrDoc should enforce principle of least privilege and conduct regular security audits focusing on authorization logic. It is advisable to implement rate limiting and anomaly detection systems that can identify unusual patterns in share modification requests, such as a single user attempting to modify shares for multiple unrelated documents. Furthermore, updating the application to version 1.1.2 or later, where these issues are reportedly patched, remains the most effective defense if available. Until patches are applied, administrators should restrict access to MrDoc instances behind robust authentication gateways and monitor logs for signs of unauthorized share manipulation attempts involving predictable token patterns.