CVE-2026-120427 in MrDoc
Summary
by MITRE • 11/02/2026
MrDoc through 1.1.1 contains a missing authorization vulnerability in the get_doctemp view that allows authenticated users to read other users' document templates. Attackers can enumerate the sequential doctemp_id POST parameter to retrieve the private template content of every user on the instance.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
The identified security flaw resides within MrDoc, a self-hosted Markdown note-taking and sharing platform, specifically affecting versions up through 1.1.1. The vulnerability is classified as an insecure direct object reference or broken access control issue located in the get_doctemp view handler. This architectural weakness stems from a failure to enforce proper authorization checks when processing requests for document templates. While the application correctly requires users to be authenticated before accessing any resources, it fails to verify that the requesting user has ownership or explicit permission rights over the specific resource being accessed. Consequently, the system relies on client-side assumptions or lacks server-side validation of object ownership against the session identity, creating a critical gap in access control logic.
From a technical perspective, the exploitation mechanism is straightforward and does not require complex payload crafting. The vulnerability leverages sequential identifiers used for document templates, known as doctemp_id parameters within POST requests. Because these IDs are predictable and increment sequentially, an authenticated attacker can perform automated enumeration by iterating through integer values of this parameter. For each valid ID encountered, the server returns the corresponding template content without verifying if the requester is the owner of that specific template. This allows for a systematic retrieval of private document templates belonging to all other users on the instance, effectively bypassing intended isolation boundaries between user accounts.
The operational impact of this vulnerability is significant regarding data confidentiality and privacy. Since MrDoc serves as a repository for potentially sensitive information such as personal notes, professional drafts, or proprietary content stored within these templates, unauthorized access constitutes a serious breach of trust. Attackers can harvest large volumes of private data simply by scripting the enumeration process. This exposure not only compromises individual user privacy but also undermines the integrity of the platform as a secure collaboration tool. In enterprise environments where MrDoc might be deployed for internal documentation, this could lead to the leakage of intellectual property or confidential business strategies stored within these templates.
This vulnerability aligns with CWE-639, which describes Authorization Bypass Through User-Controlled Key, and is categorized under MITRE ATT&CK technique T1078, specifically relating to Valid Accounts used for unauthorized access. To mitigate this risk, immediate patching to a version of MrDoc that addresses the authorization logic in the get_doctemp view is required. The fix must ensure that every request for document template data includes rigorous server-side validation confirming that the authenticated user's identity matches the owner ID associated with the requested resource. Additionally, implementing random or non-sequential identifiers for internal objects can reduce the efficiency of enumeration attacks, although strict access control checks remain the primary defense against such vulnerabilities.