CVE-2026-120427— MrDoc through 1.1.1 Missing Authorization via get_doctemp Template Read

Quick assessment

Affected

zmister2016 MrDoc

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MrDoc 1.1.1 及更早版本在视图中存在缺少授权控制的漏洞，允许已认证用户读取其他用户的文档模板。攻击者可以通过枚举这一顺序递增的 POST 参数，获取该实例上所有用户的私有模板内容。

CVSS 4.3 · Medium Updated Nov 02, 2026

Possible ATT&CK Techniques 2 AI

T1086 T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
zmister2016	MrDoc	`≤ 1.1.1`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

MrDoc through 1.1.1 Missing Authorization via get_doctemp Template Read

Source: CVE Program / CVE List V5

Vulnerability Description

MrDoc through 1.1.1 contains a missing authorization vulnerability in the get_doctemp view that allows authenticated users to read other users' document templates. Attackers can enumerate the sequential doctemp_id POST parameter to retrieve the private template content of every user on the instance.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

通过用户控制密钥绕过授权机制

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
zmister2016	MrDoc	0 ~ 1.1.1	-

II. Public POCs for CVE-2026-120427

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120427

请登录查看更多情报信息。

Other References for CVE-2026-120427 (5)

https://github.com/zmister2016/MrDoc/commit/ec93679499fb6ea88ce868ffc9169fe025917095 patch
https://github.com/zmister2016/MrDoc/blob/v1.1.1/app_doc/views.py#L1983-L1996 technical-description
https://hackmd.io/@hieund/mrdoc-get-doctemp-missing-owner-check-cross-user-template-read technical-description
https://github.com/zmister2016/MrDoc/releases/tag/v1.1.1 release-notes
https://www.vulncheck.com/advisories/mrdoc-through-1.1.1-missing-authorization-via-get-doctemp-template-read third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-120427

IV. Related Vulnerabilities

Same product: MrDoc

Same vendor: zmister2016

Same weakness: CWE-639