ShowDoc 2.4.1 allows remote attackers to edit other users' notes by navigating with a modified page_id.