CVE-2026-111364

Received Received - Intake

Insecure Direct Object Reference in MinDoc DocumentController

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to read documents from unauthorized books. Attackers holding a non-observer role on any book can name that book and iterate sequential document ids to read markdown and HTML from private books.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-111364

Affected Vendors & Products

Vendor	Product	Version / Range
mindoc-org	MinDoc	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

MinDoc through 2.2-beta.2 has an insecure direct object reference vulnerability in DocumentController.Content. Authenticated users with a non-observer role can access documents from unauthorized books by naming the book and iterating sequential document IDs to read markdown and HTML content from private books.

Detection Guidance

To detect this vulnerability, check MinDoc installations for unauthorized document access. Monitor logs for repeated requests to DocumentController.Content with sequential document IDs. Look for non-observer users accessing documents outside their assigned books.

Impact Analysis

This vulnerability allows unauthorized users to read sensitive documents from private books. If exploited, it could lead to data leaks, unauthorized access to confidential information, and potential misuse of intellectual property or personal data stored in the system.

Compliance Impact

This vulnerability could violate compliance with GDPR, HIPAA, and other privacy regulations by enabling unauthorized access to personal or sensitive data. Organizations may face legal penalties, reputational damage, and loss of trust due to data breaches resulting from this issue.

Mitigation Strategies

Immediately update MinDoc to the latest patched version. Restrict document access by enforcing role-based permissions. Audit existing document IDs to identify unauthorized access. Disable direct object reference endpoints if possible.

Hi! I’m here to help you understand CVE-2026-111364. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70