Warracker CVE-2026-120463

Requires all of: the Warracker Paperless-ngx integration enabled and configured with its single shared API token; the shared token able to read the target document; the attacker holding a normal (non-admin) authenticated Warracker account that owns at least one warranty; and the target being an 'other'-type document on another user's warranty that is not shared with the attacker. No victim interaction is needed, and the bypass works even when Global View is disabled or restricted to administrators. Limiting factors that reduce real-world risk: exploitation is confined to authenticated low-privilege users (PR:L, not anonymous), depends on the optional Paperless-ngx integration being deployed, is gated by what the shared service credential can read, and affects confidentiality only (no integrity or availability impact).

The signals point to a real but bounded issue rather than an urgent emergency. The CVSS 4.0 base score is 6.0 (medium) with vector AV:N/AC:L/AT:P/PR:L/UI:N and confidentiality-only impact (VC:H, VI:N, VA:N); PR:L confirms the attacker must be an authenticated, non-administrative user, so this is not an unauthenticated internet-facing break. No CVSS 3.1 vector was supplied in the input. No EPSS score and no CISA KEV entry are present in the provided data, so there is no evidence of active exploitation - exploitation is best characterized as no public exploit identified via KEV, though a detailed public PoC reference exists in the GHSA advisory (it is not verified as a working deployed exploit, as the author confirmed it only against the file_routes.py code using synthetic database records and a mocked Paperless-ngx API, not a live instance). The vendor-assigned priority Decision label is this_month - a hardening-cycle priority, not act_now or emergency. Mapped to an SSVC-style read: exploitation = PoC available (not active), automatable = partial (the attacker must search for and identify a specific target document), technical impact = partial (confidentiality loss only, no integrity or availability). Net: a genuine authorization/access-control defect worth patching on a normal cycle, limited by the requirements that the Paperless-ngx integration be enabled, the attacker hold a valid account, and the shared service credential be able to read the target document. Note a CWE discrepancy: the input lists CWE-862 (Missing Authorization) while the GHSA lists CWE-639 (Authorization Bypass Through User-Controlled Key) - both are authorization-class, but verify the canonical mapping with the vendor advisory.

An authenticated, non-administrative Warracker user who owns at least one warranty uses the Paperless-ngx search to locate another user's private 'other' document and links its document ID to their own warranty, after which serve_paperless_document() treats that link as proof of ownership and returns the document contents (a prior direct request returned HTTP 403, the linked request returns HTTP 200). A step-by-step PoC is published in the GHSA advisory, though it was validated only against the code with a mocked Paperless-ngx API rather than a live deployment. Given AV:N/AC:L/PR:L/UI:N, the attack is remotely performable with a normal account and no victim interaction, but requires the Paperless-ngx integration to be enabled and the shared API token to be able to read the target document.