CVE-2026-119661
Last modified
CVE-2026-119661 is a medium-severity vulnerability rated 4.2/10 on the CVSS scale. ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry id. Authenticated attackers can place their own entry id first and append other users' entry ids to permanently delete those parameter-description entries..
Description
ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry id. Authenticated attackers can place their own entry id first and append other users' entry ids to permanently delete those parameter-description entries.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| star7th | ShowDoc | <= 3.9.5 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-119661?
How severe is CVE-2026-119661?
How do I fix CVE-2026-119661?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-119656CoreShop by CoreUnion through 1.5.5 contains an unauthentica…7.5
- CVE-2026-119657FilePress through 3.0.1 contains a missing authorization vul…5
- CVE-2026-119658PowerDNS-Admin through 2026.08.1 contains an authorization b…4.3
- CVE-2026-119659Blossom through 1.17.1 contains an authorization bypass vuln…5.4
- CVE-2026-11966The User Registration & Membership WordPress plugin before …5.3
- CVE-2026-119660MuseBot before 2.0.0 contains an authentication bypass vulne…9.8
- CVE-2026-119662Songloft 2.9.0 before 2.13.6 contains a hardcoded credential…8.8
- CVE-2026-119663Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a brok…4.3
- CVE-2026-119664Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an aut…4.3
- CVE-2026-119665WHartTest 2.2.0 through 2.8.1 contains a missing authorizati…6.3
- CVE-2026-11967MobaXterm Personal Edition (Portable), in its 26.3 version (…8.5
- CVE-2026-11968Argument Injection in TortoiseGitBlame via Malicious Git His…5.5
Are you affected by CVE-2026-119661?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST