The vulnerability exists in the project_doc_sort and manage_project_doc_sort handlers of MrDoc up to version 1.1.1. It is a missing authorization flaw that allows an authenticated user to supply arbitrary document identifiers in the sort_data payload, causing the system to reparent and reorder documents belonging to other users. The problem stems from CWE‑639 and results in compromise of data integrity and confidentiality: attackers can move documents, change their status to draft or removed, and effectively hide published content.

The software affected is MrDoc, a project management application developed by zmister2016, for all releases up to and including 1.1.1.

With a CVSS score of 5.3, the vulnerability is considered medium severity. No EPSS score is available, and it is not listed in CISA KEV. The attack vector requires an authenticated user who owns or has rights to at least one project; no special privileges beyond that are necessary. An attacker can exploit the flaw by sending crafted sort_data requests with target document IDs. The lack of authorization checks allows the attacker to alter other users’ documents, impairing integrity and potentially denying access to legitimate content.