Papermerge Core CVE-2026-110624

Exploitation requires (1) a valid authenticated Papermerge account with at least low privileges (CVSS PR:L), and (2) prior knowledge of the UUID of a group the attacker is NOT a member of, which is the specific attack requirement (AT:P) - the attacker must supply that group_id to GET /tags/all or GET /document-types/all, which in versions through 3.5.3 skip the user_belongs_to membership check. Limiting factors: the UUID is not disclosed by this flaw itself and must be obtained out-of-band, there is no anonymous/unauthenticated path, and impact is confined to read-only disclosure of tag and document-type metadata (no document content, no write access).

This is a genuinely low-priority information-disclosure issue, and the signals are internally consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) correctly models a flaw that is network-reachable but requires an authenticated low-privileged account (PR:L) AND a non-trivial precondition (AT:P) - namely prior knowledge of a target group's UUID. The resulting 2.3 score aligns with the limited impact: confidentiality-only (VC:L), with no integrity or availability effect (VI:N/VA:N) and no scope change (SC:N/SI:N/SA:N), matching the description that only tag and document-type metadata of other groups is disclosed. No EPSS score, KEV listing, or POC was provided in the input, so there is no evidence of exploitation pressure to elevate priority. The one caveat worth stating: the vendor-supplied CVSS uses AC:L with AT:P to represent the UUID-knowledge requirement; in practice obtaining a valid group UUID is itself a barrier for an arbitrary attacker, so real-world exploitability is lower than a raw 'network/low-complexity' reading would suggest. Overall this is a low-CVSS, low-real-risk authorization gap - worth patching in normal maintenance, not an emergency.

A legitimate but low-privileged Papermerge user who has obtained the UUID of a group they do not belong to (e.g., leaked via logs, URLs, or a colleague) calls GET /tags/all or GET /document-types/all with that group_id, bypassing the user_belongs_to check and enumerating the other group's tags and document-type metadata. No public exploit was identified in the provided data; exploitation requires an authenticated session and foreknowledge of the target UUID, limiting opportunistic abuse.