LOW 2.3 NVD
CVE-2026-119661
ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the fir
ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry id. Authenticated attackers can place their own entry id first and append other users' entry ids to permanently delete those parameter-description entries.
References
- https://github.com/star7th/showdoc
- https://github.com/star7th/showdoc/blob/v3.9.5/server/app/Api/Controller/ParamDescLibContr
- https://github.com/star7th/showdoc/commit/53228511e656904abf7841c3d25ff78a4b5ce9c2
- https://github.com/star7th/showdoc/issues/2612
- https://hackmd.io/@hieuPenguinnn/showdoc-paramdesclib-cross-item-idor-delete
This low severity vulnerability with a CVSS score of 2.3 was published on 2026-10-30 via NVD.
vulnfeed aggregates 17712 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.