CVE-2026-119661
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry id. An authenticated attacker can place their own entry id first and append other users' entry ids to permanently delete those parameter-description entries.
Risk Assessment
An attacker can permanently delete parameter-description entries belonging to other users, causing data loss and disruption to API documentation. Only an authenticated account is required.
Recommendation
Upgrade ShowDoc to a version later than 3.9.5. Until then, restrict access to the deleteEntries endpoint or enforce permission checks for every supplied entry id.
Other vulnerabilities in ShowDoc
See all- CVE-2025-0520Critical
An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP, leading to remote code execution. This issue affects ShowDoc before 2.8.7.
- CVE-2026-120203High
ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users to execute shell commands through mockjs templates. Attackers can store a template via MockController::add with escaped parentheses that mockjs evaluates with eval(), then trigger it through MockController::infoByKey to run commands, as root in the official Docker image.
- CVE-2026-86644Low
A vulnerability in star7th showdoc up to 3.9.1 affects unknown code in the file web_src/public/editor.md/editormd.js of the API Page Save Endpoint. Manipulation can lead to cross-site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.9.2 resolves the issue. The patch sets Mermaid 'securityLevel' to 'strict', disables 'htmlLabels', and sanitizes rendered SVG with DOMPurify.
- CVE-2026-6982Medium
A vulnerability was determined in star7th ShowDoc up to 2.10.10/3.6.2/3.8.0 affecting an unknown functionality of the file server/Application/Api/Controller/PageController.class.PHP of the API Page Sort Endpoint component. Manipulation of the pages argument can lead to SQL injection. The attack may be launched remotely.
Original NVD description (English source)
ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry id. Authenticated attackers can place their own entry id first and append other users' entry ids to permanently delete those parameter-description entries.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS