CVE-2026-119661
ShowDoc through 3.9.5 Authorization Bypass via paramDescLib deleteEntries
- State
- Published
- Severity
- 2.3 Low
- Published
- Oct 30, 2026
- Updated
- Oct 30, 2026
- Reserved
- Oct 30, 2026
Description
ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry id. Authenticated attackers can place their own entry id first and append other users' entry ids to permanently delete those parameter-description entries.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 2.3 Low | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 4.2 Medium | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L | VulnCheck |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
ShowDocstar7th |
|
References
- https://github.com/star7th/showdoc/issues/2612issue-tracking
- https://github.com/star7th/showdoc/commit/53228511e656904abf7841c3d25ff78a4b5ce9c2patch
- https://github.com/star7th/showdoc/blob/v3.9.5/server/app/Api/Controller/ParamDescLibController.php#L545-L584technical-description
- https://hackmd.io/@hieuPenguinnn/showdoc-paramdesclib-cross-item-idor-deletethird-party-advisory
- https://github.com/star7th/showdocproduct
- VulnCheck Advisory: ShowDoc through 3.9.5 Authorization Bypass via paramDescLib deleteEntriesthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.