Dashboard / CVE-2026-125375

CVE-2026-125375

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 61/100
Published: 2026-11-09 Modified: 2026-11-10 First seen: 2026-11-10 Status: active

Attack Surface

Network Low Complexity No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
AT: None
VC: None
VI: Low
VA: Low

Description

MrDoc through 1.1.1 contains a missing authorization vulnerability in the project_doc_sort and manage_project_doc_sort handlers that allows registered users to modify other users' documents by supplying arbitrary document IDs in sort_data. Attackers owning any project can reparent and reorder documents by sequential ID and set their status to draft or removed, hiding published documents.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
zmister2016 MrDoc 0
zmister2016 MrDoc 0

References & Advisories (5)

Bug Bounty Relevance

61 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

5.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.28%
Raw Score 0.002780
Percentile 20.5%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00278
2026-11-12
0.00278
2026-11-10
0.00278

Intelligence Sources

mitre ref →
nvd ref →

External Links