MrDoc prior to version 1.1.1 contains a missing authorization flaw in the get_doctemp endpoint that allows any authenticated user to enumerate and read document templates belonging to other users. The vulnerability is a classic lack of ownership checks (CWE‑639) and leads to a confidentiality breach, with no known impact on integrity or availability.

The affected product is MrDoc released by zmister2016, all releases up to and including version 1.1.1 are vulnerable. Administrators should verify if their deployments run a version older than 1.1.2 or have not applied the recent patch commit.

The CVSS score of 5.3 indicates moderate severity. No EPSS data is currently available, and the vulnerability is not listed in CISA’s KEV catalog. An attacker must be authenticated and able to modify the doctemp_id parameter, but can easily discover valid IDs through enumeration, making the exploit practical in environments where the endpoint is exposed and users can enumerate IDs. Given these factors, the risk is moderate to high for organizations with exposed web interfaces and multiple user accounts.