Description

ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry id. Authenticated attackers can place their own entry id first and append other users' entry ids to permanently delete those parameter-description entries.

Related CPE's

Could not find any relations

References

https://github.com/star7th/showdoc

https://github.com/star7th/showdoc/blob/v3.9.5/server/app/Api/Controller/ParamDescLibController.php#L545-L584

https://github.com/star7th/showdoc/commit/53228511e656904abf7841c3d25ff78a4b5ce9c2

https://github.com/star7th/showdoc/issues/2612

https://hackmd.io/@hieuPenguinnn/showdoc-paramdesclib-cross-item-idor-delete

https://www.vulncheck.com/advisories/showdoc-through-3.9.5-authorization-bypass-via-paramdesclib-deleteentries

Weaknesses

[email protected]

Secondary
CWE-639

CVSS impact metrics

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

4.2 · Medium

Information

Source identifier

[email protected]

Vulnerability status

Deferred

Published

2026-10-30T15:16:50.360Z

5 hours ago

Last modified

2026-10-30T19:23:25.493Z

1 hour ago