Warracker
Monthly
Warracker releases up to and including 1.0.3 mishandle authorization in their Paperless-ngx integration, letting any signed-in non-administrative user who owns at least one warranty link another user's private Paperless document to their own warranty and then download it, because the presence of a document ID on a warranty is treated as proof of ownership. Exploitation requires the optional Paperless-ngx integration to be enabled with a shared API token that can read the target document, and affects confidentiality only (private receipts, invoices and similar records) with no integrity or availability impact assessed. The vendor has fixed the flaw in 1.0.4; a public proof-of-concept walkthrough exists in the GHSA advisory, but it was validated against synthetic records and a mocked Paperless-ngx API rather than a live deployment, so it is not verified as working exploit code, and the issue is rated for this-month remediation rather than emergency action.
Warracker releases up to and including 1.0.3 mishandle authorization in their Paperless-ngx integration, letting any signed-in non-administrative user who owns at least one warranty link another user's private Paperless document to their own warranty and then download it, because the presence of a document ID on a warranty is treated as proof of ownership. Exploitation requires the optional Paperless-ngx integration to be enabled with a shared API token that can read the target document, and affects confidentiality only (private receipts, invoices and similar records) with no integrity or availability impact assessed. The vendor has fixed the flaw in 1.0.4; a public proof-of-concept walkthrough exists in the GHSA advisory, but it was validated against synthetic records and a mocked Paperless-ngx API rather than a live deployment, so it is not verified as working exploit code, and the issue is rated for this-month remediation rather than emergency action.