Vendor
Papermerge Core versions through 3.5.3 contain a missing authorization vulnerability allowing authenticated users to manipulate or process documents belonging to other users via predictable API endpoints.