CVE-2026-111645 zmister2016 CVE debrief

Who should care

Defenders responsible for MrDoc installations, particularly those using version 1.1.1 or earlier, should assess exposure and prioritize patching to prevent unauthorized document modifications.

Why it matters

CVE-2026-111645 is a missing authorization vulnerability in MrDoc's ImportLocalDoc API, allowing authenticated users to modify other users' documents and projects. Defenders should prioritize verifying and patching MrDoc installations to prevent unauthorized document modifications.

• Potential unauthorized modification of documents and projects by authenticated users.
• Possible disruption of document management workflows.
• Need for verification of MrDoc installations and user access controls.
• Potential data integrity issues if exploited.

Technical summary

The vulnerability exists in the ImportLocalDoc API of MrDoc through version 1.1.1. It allows authenticated users to modify other users' documents and projects by manipulating document IDs in PUT or POST requests. This can lead to unauthorized modification of documents and projects, disrupting document management workflows and potentially causing data integrity issues. Defenders should prioritize verifying and patching MrDoc installations to prevent unauthorized document modifications, and consider restricting access to the ImportLocalDoc API to authorized users only.

Defensive priority

Defenders should prioritize verifying and patching MrDoc installations to prevent unauthorized document modifications.

Recommended defensive actions

• Verify MrDoc installations for version 1.1.1 or earlier and apply patches if available.
• Restrict access to the ImportLocalDoc API to authorized users only.
• Monitor for suspicious activity related to document modifications.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description and affected versions. However, additional information on exploitation or impact is limited. Defenders should verify MrDoc installations and user access controls, monitor for suspicious activity related to document modifications, and consider the potential for data integrity issues if exploited. The lack of detailed information on exploitation or impact requires a cautious approach to verifying and patching MrDoc installations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.