Papermerge Core EUVD-2026-101251

Requires an authenticated low-privileged account on the target Papermerge Core instance (PR:L) and knowledge of the victim's node (document/folder) UUID, which the attacker supplies to POST /shared-nodes or PATCH /shared-nodes/access/{node_id}. No user interaction by the victim is needed. Exploitation is LIMITED by two factors: a valid session is required (not unauthenticated), and node identifiers are random UUIDs that are not enumerable (reflected as AT:P), so an attacker must already know or capture the target UUID - making opportunistic mass exploitation impractical and concentrating real risk in multi-tenant deployments where UUIDs can be shared, leaked, or observed. The vulnerable behavior is present in default configurations of versions through 3.5.3 (no non-default setting needed to be affected).

This is a genuine access-control flaw (CWE-862, missing authorization) in Papermerge Core's shared-nodes API, confirmed by the vendor commit (0fd4691) which adds ownership.user_can_access_resource() checks to the POST /shared-nodes, GET /shared-nodes/access/{node_id}, and PATCH /shared-nodes/access/{node_id} handlers - strong corroboration that the vulnerability is real and now patched. The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) and score of 7.7 indicate a network-reachable issue that requires an authenticated low-privileged account (PR:L) and carries an attack requirement (AT:P), which aligns with the description's dependency on the attacker supplying valid victim node UUIDs. Impact is high across confidentiality, integrity, and availability (VC:H/VI:H/VA:H) because a successful attacker can read, modify, and delete other users' documents and revoke their shares. No EPSS score was provided, the CVE is not listed in CISA KEV, and no public exploit or POC was indicated in the input, so there is no public exploit identified at time of analysis; the only exploitation signal is the vendor/VulnCheck advisory and patch, pointing to a disclosed-but-not-yet-widely-weaponized issue. The main dampening factor is AT:P: because node identifiers are random UUIDs rather than enumerable integers, blind mass exploitation is impractical, so realistic risk is concentrated in multi-tenant instances where an attacker can obtain or observe target UUIDs - this is a real priority for shared Papermerge deployments but not an indiscriminate internet-wide threat.

A low-privileged but legitimate user on a shared, multi-tenant Papermerge instance obtains or guesses another user's document/folder node UUID and sends POST /shared-nodes (or PATCH /shared-nodes/access/{node_id}) referencing that UUID, granting themselves a role on a resource they do not own. They then read confidential documents, alter or delete them, and revoke the owner's legitimate shares. No public exploit code was identified in the provided data, but the attack is a straightforward authenticated API call requiring only a valid node UUID.