CVE-2026-120427

MrDoc through 1.1.1 contains a missing authorization vulnerability in the get_doctemp view that allows authenticated users to read other users' document templates. Attackers can enumerate the sequential doctemp_id POST parameter to retrieve the private template content of every user on the instance.

An authenticated user can access private document templates of other users, resulting in a confidentiality breach. This may lead to leakage of business information or sensitive content.

Update MrDoc to a version later than 1.1.1 if available, or implement authorization checks in the get_doctemp view. Consider restricting template access to trusted users until a fix is applied.