MinDoc versions up to 2.2-beta.2 contain a direct object reference flaw in the DocumentController.Content endpoint that permits any authenticated user to read files from books to which the user does not belong. By supplying a book identifier and iterating sequential document IDs, attackers can retrieve Markdown and HTML payloads stored in private books, exposing sensitive information to unprivileged personnel.

The vulnerability exists in the mindoc-org MinDoc product, specifically in releases 2.2-beta.2 and earlier. All deployments running that version are affected until a patch is applied to the DocumentController or the associated routing logic.

The flaw receives a CVSS score of 7.1, indicating a high potential for significant impact on confidentiality. The EPSS score is < 1%, indicating a very low but nonzero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with any role on the platform; the attacker does not need elevated privileges beyond a standard user account and can enumerate document IDs to access content across books.