Is CVE-2026-111364 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-111364?

CVE-2026-111364 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-111364

Description

MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to read documents from unauthorized books. Attackers holding a non-observer role on any book can name that book and iterate sequential document ids to read markdown and HTML from private books.