PT-2026-135443
CVE-2026-120427
·
Published
2026-11-02
·
Updated
2026-11-02
Description by
CVSS 3.1
4.3
MediumMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
MrDoc through 1.1.1 contains a missing authorization vulnerability in the get doctemp view that allows authenticated users to read other users' document templates. Attackers can enumerate the sequential doctemp id POST parameter to retrieve the private template content of every user on the instance.
Found an issue in the description? Have something to add? Feel free to write us 👾