CVE-2026-111364

Name of the Vulnerable Software and Affected Versions MinDoc versions prior to 2.2-beta.3

Description An insecure direct object reference (IDOR) exists in the DocumentController.Content function. This allows authenticated users with a non-observer role on any book to access markdown and HTML content from private books by specifying a book name and iterating through sequential document IDs via the '/api/:key/content/:id' endpoint. IDOR is a type of access control flaw where an application provides direct access to objects based on user-supplied input.

Recommendations Update MinDoc to version 2.2-beta.3 or later.