Authentication Bypass in Documenso File Upload Endpoint

Documenso versions prior to 2.13.0 contain an authentication bypass vulnerability, tracked as CVE-2026-82472. The application fails to enforce authentication, session validation, or API credential requirements on the /api/files/upload-pdf endpoint. This allows any unauthenticated actor with network access to the Documenso instance to upload arbitrary PDF files.

Defenders should prioritize this vulnerability as it enables unauthorized resource consumption. Attackers can leverage this to exhaust disk storage or populate the application database with excessive unlinked document records, leading to a denial-of-service (DoS) condition. As this endpoint does not validate the source of the upload, it may also be used to bypass intended business workflows.

Impact

Successful exploitation allows unauthenticated remote actors to cause a denial-of-service by overwhelming system resources. This impacts the availability and integrity of the document storage backend and database performance for all users of the affected Documenso instance.

Recommendation

Prioritized actions for security teams:

• Upgrade all instances of Documenso to version 2.13.0 or later to apply the fix for CVE-2026-82472.
• Implement network-level access controls or a Web Application Firewall (WAF) to restrict access to the /api/files/upload-pdf endpoint to known, trusted IP ranges until patching is complete.
• Monitor web server access logs for anomalous, high-frequency POST requests to /api/files/upload-pdf originating from unauthorized or unexpected source IPs.