CVE-2026-111364 — MinDoc through 2.2-beta.2 IDOR via /api/:key/content/:id GET Branch
MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to read documents from unautho…
Published: 2026-10-15 · CVSS: 7.1 · CVSS 4.0
MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to read documents from unauthorized books. Attackers holding a non-observer role on any book can name that book and iterate sequential document ids to read markdown and HTML from private books.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7