EUVD-2026-102494
GHSA-xxc7-55p3-gxvw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as any Papermark user
-
ExploitEnumerate victim team, dataroom and group IDs
-
ExecutionSend DELETE/PUT to groups API
-
ImpactDestroy or rewrite cross-team viewer groups and share links
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated Papermark account (PR:L) on a multi-tenant/shared instance, plus knowledge of the target team's teamId, data room id, and viewer-group groupId (the AT:P attack requirement) to call the /api/teams/[teamId]/datarooms/[id]/groups/[groupId] endpoints. Only Papermark deployments through 0.22.0 that use data-room viewer groups and share links are affected. Limiting factors: it is NOT unauthenticated (an account is mandatory), it depends on obtaining/enumerating opaque cross-team identifiers, and impact is confined to viewer-group deletion, link disclosure, and permission rewrites rather than full account or system compromise. |
| Impact | This is a genuine but low-urgency broken-access-control (CWE-862) flaw, and the signals are internally consistent rather than conflicting. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L) scores only 2.3 because, although the API is network-reachable, exploitation requires an authenticated low-privilege account (PR:L) AND a specific attack prerequisite (AT:P) - the attacker must already know the victim team's teamId, data room id, and groupId - while impact is limited to Low across confidentiality, integrity and availability with no scope change (SC/SI/SA:N). No EPSS score, CISA KEV listing, or SSVC decision data was provided in the input, and no public exploit code is referenced (the hackmd link and VulnCheck advisory are technical write-ups/disclosure, not weaponized PoC). Taken together this is a real, confirmed-and-patched cross-tenant authorization bug worth remediating in a multi-tenant SaaS/self-hosted deployment, but it is not a mass-exploitation priority: the low CVSS reflects authentication plus identifier-knowledge requirements that genuinely limit real-world risk, so treat it as standard patch-cycle work rather than emergency response. |
| Exploit ScenarioDerived | An attacker registers or already holds a valid low-privilege Papermark account on a shared/multi-tenant instance, learns (or enumerates) another team's data room and viewer-group identifiers, and issues DELETE requests to the groups API to destroy that team's viewer groups and share links, or sends read/update requests to view group links and rewrite document permissions. No public exploit code is identified, but a detailed disclosure write-up exists describing the exact vulnerable endpoints. Exploitation is cross-tenant data tampering/destruction rather than remote code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Authenticated cross-tenant access control failure in Papermark through 0.22.0 lets any user with a valid account delete another team's data room viewer groups, read those groups' share links, and rewrite their document permissions by issuing requests to the /api/teams/[teamId]/datarooms/[id]/groups/[groupId] endpoints with another team's identifiers. No public exploit identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV entry), but exploitation only requires a low-privileged authenticated account plus knowledge or enumeration of a target team's teamId, data room id, and groupId, which is why the CVSS 4.0 base of 2.3 (driven by the AT:P attack-requirement metric) sits well below our independent CVSS 3.1 assessment of AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. Impact is bounded to viewer-group deletion, share-link disclosure, and permission rewrites within multi-tenant deployments that use data room viewer groups and share links - not full account, host, or data-plane compromise - but the integrity consequences for a victim's document-sharing posture are real, and the exposed share links should be treated as disclosed.
RemediationAI
Upgrade Papermark beyond 0.22.0 as soon as a tagged release containing the fix is available; the vendor-supplied fix is delivered as upstream commits - https://github.com/papermark/papermark/commit/b81cf62f390cda112f35538eb09e54b5f728b74a (adds the missing prisma.userTeam membership checks on the group endpoints, returns 403 when the caller is not a member of the teamId, and scopes the group query to teamId) and https://github.com/papermark/papermark/commit/7fa52b23944823a9e74402fca8e48d644239bc0b (group links handler) - so deployments tracking a release tag should treat this as "upstream fix available (PR/commit); released patched version not independently confirmed" and either build from the patched commit or wait for the next tagged release, applying the accompanying Prisma migration (ON DELETE CASCADE on View→Link and Domain→Link) rather than the code alone. Until then, compensating controls with explicit trade-offs are: (1) disable data room viewer groups and group-based share links for untrusted or cross-tenant users - this removes the vulnerable route's practical reach but breaks legitimate viewer-group sharing workflows; (2) audit and rotate every share link belonging to a data room viewer group, since the same missing check permits link disclosure - rotation invalidates legitimate recipients' existing URLs and requires re-issuing them; (3) enforce tenant isolation at the reverse proxy or application gateway by rejecting requests whose authenticated session's team does not match the teamId path segment on /api/teams/*/datarooms/*/groups/* - workable for the deletion and mutation verbs but it is a blunt filter that must be kept in sync with route changes and may break legitimate multi-team membership; (4) review server and Prisma logs for cross-team DELETE, GET-on-links, and permission-update requests against these endpoints to detect prior abuse, since the flaw has existed in every release through 0.22.0 and exploitation leaves the victim's viewer group deleted or its permissions silently rewritten. Monitor the vendor repository and the VulnCheck advisory (https://www.vulncheck.com/advisories/papermark-through-0.22.0-missing-authorization-in-data-room-viewer-group-api) for the exact patched version number; do not rely on identifier obscurity as a control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Papermark is an open-source, multi-tenant document-sharing and virtual data room platform built on Next.js API routes with Prisma over a relational database. The affected handlers live in pages/api/teams/[teamId]/datarooms/[id]/groups/[groupId]/index.ts and .../links.ts, which expose the viewer-group lifecycle (including deletion and permission/document assignment) and the group's share-link listing. The root cause is CWE-862 (Missing Authorization): the route relies on client-supplied path parameters - teamId, data room id, and groupId - to scope the database lookup, but the vulnerable code paths never verify that the authenticated session user actually belongs to the teamId in the URL before acting on the referenced viewer group. The upstream fix replaces the earlier, weaker membership lookups (prisma.team.findUnique / findFirst filtering on team id and a nested users relation) with an explicit prisma.userTeam.findUnique lookup keyed on the composite userId_teamId relationship, returns 403/401 when that membership record is absent, and additionally pins teamId into the group query predicate so a group can only be mutated within the team that owns it. The accompanying migration and schema change adds ON DELETE CASCADE to the View→Link foreign key (and the Domain→Link relation), tightening cleanup semantics for share links and their associated view records. Because the identifiers are opaque but stable and exposed to any tenant user who can observe them (URLs, API responses, support artifacts, or simple enumeration), the missing server-side tenant check - not the secrecy of the IDs - is what the vulnerability ultimately rests on.
Know when Papermark gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Network API reachable by any authenticated user (AV:N/PR:L); low Low impacts because an attacker can read group links (C:L), rewrite permissions (I:L) and delete groups/links (A:L) within the app's authority (S:U).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Papermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer group API that allows authenticated users to delete other teams' viewer groups and share links. Attackers who know a victim team's data room and group identifiers can send DELETE requests, read group links, or rewrite group document permissions across teams.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB