CVE-2026-119661

low

Description

ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry id. Authenticated attackers can place their own entry id first and append other users' entry ids to permanently delete those parameter-description entries.

References

https://www.vulncheck.com/advisories/showdoc-through-3.9.5-authorization-bypass-via-paramdesclib-deleteentries

https://hackmd.io/@hieuPenguinnn/showdoc-paramdesclib-cross-item-idor-delete

https://github.com/star7th/showdoc/issues/2612

https://github.com/star7th/showdoc/commit/53228511e656904abf7841c3d25ff78a4b5ce9c2

https://github.com/star7th/showdoc/blob/v3.9.5/server/app/Api/Controller/ParamDescLibController.php#L545-L584

https://github.com/star7th/showdoc

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-114077

Details

Source: Mitre, NVD

Published: 2026-10-30

Updated: 2026-10-30

Risk Information

CVSS v2

Base Score: 3.6

Vector: CVSS2#AV:N/AC:H/Au:S/C:N/I:P/A:P

Severity: Low

CVSS v3

Base Score: 4.2

Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

Severity: Medium

CVSS v4

Base Score: 2.3

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Severity: Low

EPSS

EPSS: 0.00379