Papermerge Core CVE-2026-110622

Requires (1) a valid authenticated low-privileged account on the Papermerge Core instance (PR:L), and (2) out-of-band knowledge of the victim's page UUIDs, since the /pages/, /pages/move, /pages/extract, and /tasks/ocr endpoints omit the has_node_perm permission check (AT:P reflects this UUID-knowledge requirement). A multi-user or multi-tenant deployment is needed for other users' pages to exist as targets. Limiting factors: page UUIDs are random 128-bit identifiers not disclosed to unauthorized users by default, no privilege escalation to admin is granted, and no victim user interaction is required. Single-user/self-hosted installations with no other accounts have no exploitable victims.

This is a genuine but moderate-priority access-control flaw rather than a critical internet-wide emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H) scores 7.7 High and is internally consistent with the description: network-reachable API endpoints, low attack complexity, but crucially PR:L (a valid low-privileged account is required) and AT:P (a specific attack requirement - the attacker must know the victim's page UUIDs). The VC:H/VI:H/VA:H ratings are justified because an attacker can extract (read), rotate/move (modify), and delete (destroy) another user's pages. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so there is no signal of active exploitation or mass automatability. The AT:P requirement is the key risk-limiter: Papermerge page identifiers are random UUIDs not exposed to unauthorized users by default, so exploitation is realistic for insiders or in multi-tenant deployments where UUIDs can be learned, but is not a spray-and-pray remote attack. Net: real priority for any shared/multi-user Papermerge instance, but the authentication requirement plus UUID-knowledge precondition keep real-world exploitation targeted rather than widespread. Note the input tag 'Authentication Bypass' is imprecise - CWE-862 and the fix (adding has_node_perm checks) show this is a missing-authorization / IDOR issue, not an authentication bypass.

On a multi-user Papermerge Core instance (≤3.5.3), a low-privileged but authenticated attacker who has learned another user's page UUIDs sends a request to /pages/, /pages/move, /pages/extract, or /tasks/ocr. Because these endpoints skip the has_node_perm authorization check, the server rotates, deletes, moves, extracts, or OCRs the victim's pages despite the attacker having no permission on them. No public exploit was identified at time of analysis, though the vendor patch commit ships negative test cases that concretely demonstrate the unauthorized operations.