CVE-2026-110622
HighCVSS 7.5Summary
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip has_node_perm checks. Attackers knowing page UUIDs can rotate, delete, or extract victims' pages and trigger OCR.
Risk Assessment
An attacker can modify or delete other users' pages, leading to a breach of data integrity and potential information loss.
Recommendation
Update Papermerge Core to a version later than 3.5.3 and ensure has_node_perm checks are enforced in all page management and OCR endpoints.
Other vulnerabilities in Papermerge Core
See all- CVE-2026-110624Low
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by supplying a group_id parameter. Attackers who know a group's UUID can query GET /tags/all or GET /document-types/all, which skip the user_belongs_to check, to disclose metadata of groups they do not belong to.
- CVE-2026-110623High
Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API. Authenticated users can share other users' documents by supplying arbitrary node UUIDs, then read, modify, or delete victims' documents and revoke existing shares.
Original NVD description (English source)
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip has_node_perm checks. Attackers knowing page UUIDs can call /pages/, /pages/move, or /pages/extract to rotate, delete, or extract victims' pages, and trigger OCR via /tasks/ocr.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS