The vulnerability is an object‑level authorization flaw in MrDoc’s ImportLocalDoc API. Authenticated users can target other users’ documents by crafting PUT or POST requests with arbitrary identifiers, changing document visibility, reparenting, or injecting new documents. This gives attackers the ability to alter or expose private drafts and project structures, compromising data integrity and potentially leaking sensitive information.

Affected systems are deployments of MrDoc version 1.1.1 and earlier under the vendor zmister2016:MrDoc. The flaw exists in the import module located in views_import.py as referenced, and any installation that has not applied a later patch will be vulnerable. Current releases beyond 1.1.1 should be checked for the fix, as the advisory does not list later versions.

The CVSS base score is 5.3, indicating moderate severity. Exploitation requires a valid authenticated account; there is no evidence of remote code execution or privilege escalation. The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. Nevertheless, the ability to modify other users’ documents poses a significant risk to data integrity and confidentiality for organizations using shared environments.