Cpe:2.3:a:papermerge:papermerge_core:*:*:*:*:*:*:*:*

Papermerge Core versions through 3.5.3 contain a missing authorization vulnerability allowing authenticated users to manipulate or process documents belonging to other users via predictable API endpoints.