Papermerge Core
Monthly
Missing authorization in Papermerge Core through 3.5.3 lets any authenticated user seize control of documents and folders they do not own by supplying the victim's node UUID to the shared-nodes API, then granting themselves an arbitrary role to read, modify, delete, or unshare those nodes. Exploitation requires a valid low-privileged account and knowledge of the target UUID (which is a non-enumerable random identifier, reflected as the AT:P attack-complexity component in the assessed vector), so opportunistic mass exploitation is impractical and real risk concentrates in multi-tenant or shared-link environments where UUIDs may leak. The vendor has released a fix, and no public exploit was identified at time of analysis.
Authenticated low-privileged users on multi-user Papermerge Core deployments can manipulate documents they do not own: the page management endpoints (/pages/, /pages/move, /pages/extract) and the OCR task endpoint (/tasks/ocr) skip the has_node_perm authorization check, letting an attacker rotate, delete, move, or extract another user's pages and queue OCR jobs against them. Exploitation requires a valid account plus out-of-band knowledge of the victim's random 128-bit page UUIDs, so it is a genuine but moderate-priority access-control failure rather than an internet-wide emergency; a patch commit has been published upstream, though a tagged release containing it was not independently confirmed, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated Papermerge Core users can query the GET /tags/all and GET /document-types/all endpoints with a group_id parameter to read tag and document-type metadata belonging to groups they are not members of. The flaw is a missing authorization check (CWE-862) present through version 3.5.3: those routes omit the user_belongs_to membership validation, so anyone who already knows a target group's UUID receives the group's tag and document-type listings instead of a 403. Exploitation requires a valid low-privileged account plus prior out-of-band knowledge of a foreign group's UUID (CVSS 4.0 AT:P, PR:L), the impact is read-only metadata disclosure limited to low confidentiality (no document content, no writes), and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Missing authorization in Papermerge Core through 3.5.3 lets any authenticated user seize control of documents and folders they do not own by supplying the victim's node UUID to the shared-nodes API, then granting themselves an arbitrary role to read, modify, delete, or unshare those nodes. Exploitation requires a valid low-privileged account and knowledge of the target UUID (which is a non-enumerable random identifier, reflected as the AT:P attack-complexity component in the assessed vector), so opportunistic mass exploitation is impractical and real risk concentrates in multi-tenant or shared-link environments where UUIDs may leak. The vendor has released a fix, and no public exploit was identified at time of analysis.
Authenticated low-privileged users on multi-user Papermerge Core deployments can manipulate documents they do not own: the page management endpoints (/pages/, /pages/move, /pages/extract) and the OCR task endpoint (/tasks/ocr) skip the has_node_perm authorization check, letting an attacker rotate, delete, move, or extract another user's pages and queue OCR jobs against them. Exploitation requires a valid account plus out-of-band knowledge of the victim's random 128-bit page UUIDs, so it is a genuine but moderate-priority access-control failure rather than an internet-wide emergency; a patch commit has been published upstream, though a tagged release containing it was not independently confirmed, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated Papermerge Core users can query the GET /tags/all and GET /document-types/all endpoints with a group_id parameter to read tag and document-type metadata belonging to groups they are not members of. The flaw is a missing authorization check (CWE-862) present through version 3.5.3: those routes omit the user_belongs_to membership validation, so anyone who already knows a target group's UUID receives the group's tag and document-type listings instead of a 403. Exploitation requires a valid low-privileged account plus prior out-of-band knowledge of a foreign group's UUID (CVSS 4.0 AT:P, PR:L), the impact is read-only metadata disclosure limited to low confidentiality (no document content, no writes), and no public exploit code or confirmed active exploitation has been identified at time of analysis.