SZB-6e2df560c1
EUVD-2026-114077 reports authorization bypass in ShowDoc through 3.9.5
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- ShowDoc
- Product
- ShowDoc
- First seen
Summary
The EU Vulnerability Database (EUVD) entry EUVD-2026-114077 describes an authorization bypass in ShowDoc through 3.9.5, scored 2.3/10 (CVSS v3.1). Per the listing, the deleteEntries endpoint checks edit permission only for the first supplied entry ID.
If you use ShowDoc
Upgrade ShowDoc past 3.9.5 once a fixed release is available
Limit editing rights for ShowDoc users until patched
What the sources say 1
· Mastodon: “ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry id.” Source