{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/papermerge/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:papermerge:papermerge_core:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-110622"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Papermerge Core (\u003c= 3.5.3)"],"_cs_severities":["medium"],"_cs_tags":["web-application-vulnerability","authorization-bypass","access-control"],"_cs_type":"advisory","_cs_vendors":["Papermerge"],"content_html":"\u003cp\u003ePapermerge Core versions up to and including 3.5.3 are susceptible to a missing authorization vulnerability (CVE-2026-110622). This vulnerability stems from the failure of specific page management and OCR API endpoints to verify the \u003ccode\u003ehas_node_perm\u003c/code\u003e permission check for authenticated users. An attacker with a valid low-privileged account can interact with these endpoints by providing the UUIDs of pages owned by other users. Successful exploitation allows unauthorized modification of document structures, including page rotation, deletion, and extraction, as well as the ability to trigger resource-intensive OCR tasks. This flaw poses a significant risk to data integrity and server availability within multi-user Papermerge deployments.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows authenticated attackers to manipulate or delete documents belonging to other users, potentially leading to unauthorized data destruction or information access. Furthermore, unauthorized triggers of OCR tasks can be used to cause denial-of-service conditions by exhausting server-side processing resources. This vulnerability impacts all installations of Papermerge Core up to version 3.5.3.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for administrators of Papermerge Core:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eApply the security patch provided by the vendor immediately to address CVE-2026-110622.\u003c/li\u003e\n\u003cli\u003eAudit access logs for unauthorized HTTP requests to the \u003ccode\u003e/pages/\u003c/code\u003e and \u003ccode\u003e/tasks/\u003c/code\u003e endpoints by users who do not own the associated document UUIDs.\u003c/li\u003e\n\u003cli\u003eLimit access to the Papermerge application to trusted users only, as the vulnerability requires an authenticated session to exploit.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T16:37:02Z","date_published":"2026-10-14T16:37:02Z","id":"https://feed.craftedsignal.io/briefs/2026-10-papermerge-auth-bypass/","summary":"Papermerge Core versions through 3.5.3 contain a missing authorization vulnerability allowing authenticated users to manipulate or process documents belonging to other users via predictable API endpoints.","title":"Missing Authorization Vulnerability in Papermerge Core","url":"https://feed.craftedsignal.io/briefs/2026-10-papermerge-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Papermerge","version":"https://jsonfeed.org/version/1.1"}