A broken access control flaw exists in MrDoc earlier than version 1.1.1, specifically within the manage_doc_share type 3 branch. The update handler fails to verify that the authenticated user is the document owner, allowing any logged‑in user to change other users’ share settings. Because the system derives share tokens from an MD5 hash of the document ID and username, an attacker can compute predictable tokens and re‑enable disabled shares or remove access codes, exposing private documents to unintended recipients.

MrDoc v1.1.1, developed by zmister2016, is the only affected version. All installations of MrDoc that are running this version or earlier are vulnerable until the ownership check is implemented.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting a lower likelihood of wide‑scale exploitation yet still representing a tangible risk. Attackers only need a legitimate authenticated account, and the bug does not provide remote code execution or privilege escalation, but it does permit unauthorized disclosure of documents by manipulating share settings.