EUVD-2026-85812
GHSA-hcgg-7hh4-grvw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach PaperCut web interface remotely
-
DeliverySubmit report-generation request without credentials
-
ExploitServer bypasses authentication/authorization check
-
ExecutionRetrieve generated report
-
ImpactHarvest sensitive information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Exploitation requires network reachability to the PaperCut MF/NG application server's report-generation endpoint; per CVSS PR:N/UI:N no credentials or user interaction are needed, so any exposed instance is reachable by an unauthenticated remote attacker. The practical limit on risk is exposure and impact scope: the affected functionality is report generation, and successful abuse yields only sensitive-information disclosure (VC:L/SC:L, no integrity or availability impact). Real-world exposure is constrained by whether the PaperCut interface is internet-facing versus restricted to an internal management network; internally-segmented deployments are reachable only by attackers already on the LAN. |
| Impact | Moderate, real-but-bounded risk. The CVSS 4.0 vector (6.9) is internally consistent with the description: AV:N/AC:L/AT:N/PR:N/UI:N means a remote, unauthenticated attacker can reach the flaw with no complexity or interaction, and the AU:Y supplemental marks exploitation as automatable - both signals that raise practical concern. However, impact is deliberately narrow: only VC:L/SC:L (low confidentiality), with VI:N/VA:N - this is information disclosure via unauthorized report generation, not code execution, data tampering, or DoS. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent exploitation; the automatable-and-unauthenticated profile means opportunistic scanning could emerge once details are public, but at analysis time this is a patch-in-normal-cycle item rather than an emergency. Note a labeling tension: the description says 'improper authentication' while the assigned CWE-639 is authorization-bypass-through-user-controlled-key - the exact bug class (missing auth check vs. broken object-level authorization on report requests) is not fully pinned down and should be confirmed against the PaperCut bulletin. |
| Exploit ScenarioDerived | An attacker who can reach the PaperCut MF/NG web interface over the network sends crafted report-generation requests without supplying valid credentials, and the server processes them, returning reports that expose sensitive operational data (e.g., user activity, print/usage records). No public exploit code was identified, but the unauthenticated, low-complexity, automatable nature means a working request could be scripted and sprayed across exposed instances. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
PaperCut MF/NG's report-generation functionality can be reached without valid credentials, letting an unauthenticated remote attacker trigger report generation and read the sensitive information those reports expose. The defect is an authentication/authorization bypass (CWE-639) that needs only network reachability to the application server - no credentials and no user interaction (PR:N/UI:N) - and is scoped to confidentiality loss (VC:L/SC:L, with no integrity or availability impact), which keeps overall risk moderate and bounded at a CVSS score of 6.9. No public exploit code has been identified at time of analysis and the issue has not been confirmed as actively exploited (not in CISA KEV).
RemediationAI
Apply the fixed release named in PaperCut's security bulletin (https://www.papercut.com/kb/Main/security-bulletin-sep-2026/); patch availability is per that vendor advisory and no independently confirmed patched version number is present in the available data, so verify the build number against the bulletin before relying on it. Where immediate upgrade is not possible, the highest-value compensating control is eliminating network reachability to the report-generation endpoint: deny inbound access to the PaperCut application server from untrusted networks, bind the administrative and reporting interfaces to internal addresses only, and require VPN or jump-host access for administrators - the trade-off being that legitimate remote and scheduled report generation must be rerouted through those trusted channels. Blocking unauthenticated requests to the reporting path with an ACL, reverse-proxy rule, or WAF signature can reduce casual abuse but is a bypassable, signature-based measure and must not substitute for patching. Because the flaw is automatable (CVSS 4.0 AU:Y) and leaves only indirect traces, enable and review web-server and application logs for unauthenticated or anomalous report-generation requests, and treat unexpected report activity as a potential confidentiality incident. PaperCut MF/NG interfaces should not be exposed directly to the internet.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a missing authorization check in the report-generation path: the application services report requests without first validating that the caller is authenticated and entitled to the requested report, a failure class captured by CWE-639 (Authorization Bypass Through User-Controlled Key), where a user-influenced request or identifier is trusted in place of a real access-control decision. PaperCut MF and NG are print-management platforms that centralize queue, device, user and accounting data, and the reporting subsystem aggregates exactly that kind of operational data, which is why successful abuse yields information disclosure rather than code execution. The supplied CVSS v4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N) confirms network-reachable, low-complexity, unauthenticated, no-interaction exploitation with only limited confidentiality impact inside and beyond the vulnerable component, and the AU:Y supplemental metric indicates the attack is automatable and therefore scriptable at scale; the independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) agrees on a confidentiality-only, low-severity-per-metric outcome. No EPSS score, exploit-maturity value, or CPE identifiers for specific builds were supplied, so deployment-specific exposure must be determined from the vendor bulletin rather than inferred here.
Know when Papercut gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/AU:Y
Remote unauthenticated report request with no interaction (AV:N/AC:L/PR:N/UI:N); only low confidentiality impact from disclosed report data, no integrity/availability effect, scope unchanged.
Primary rating from Vendor (eb41dac7-0af8-4f84-9f6d-0272772514f4).
CVSS VectorVendor: eb41dac7-0af8-4f84-9f6d-0272772514f4
Lifecycle Timeline
2DescriptionCVE.org
An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report generation requests without valid credentials, an attacker can generate reports and gain unauthorized access to sensitive information.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Authentication bypass in PaperCut NG and PaperCut MF print management software allows unauthenticated remote attackers t
Remote code execution affects PaperCut MF and PaperCut NG through unsafe dynamic class loading in the database connectio
Improper access control (CWE-305) in the PaperCut MF and PaperCut NG web management interface allows unauthenticated rem
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Bui
PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in PaperCut NG/MF, which, under specific condition
The `PaperCutNG Mobility Print` version 1.0.3512 application allows an unauthenticated attacker to perform a CSRF attack
PaperCut NG allows for unauthenticated XMLRPC commands to be run by default. Rated medium severity (CVSS 6.5), this vuln
This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated
An unspecified vulnerability in the application server in PaperCut MF and NG versions 18.3.8 and earlier and versions 19
PaperCut MF before 18.3.6 and PaperCut NG before 18.3.6 allow script injection via the user interface, aka PC-15163. Rat
An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print
Exploit-DB