CVE-2026-110623
HighCVSS 7.5Summary
Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API. Authenticated users can share other users' documents by supplying arbitrary node UUIDs, then read, modify, or delete victims' documents and revoke existing shares.
Risk Assessment
An attacker can access, modify, or delete other users' documents, leading to a breach of data confidentiality and integrity.
Recommendation
Update Papermerge Core to a version later than 3.5.3 and implement authorization checks for the /shared-nodes endpoints.
Other vulnerabilities in Papermerge Core
See all- CVE-2026-110624Low
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by supplying a group_id parameter. Attackers who know a group's UUID can query GET /tags/all or GET /document-types/all, which skip the user_belongs_to check, to disclose metadata of groups they do not belong to.
- CVE-2026-110622High
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip has_node_perm checks. Attackers knowing page UUIDs can rotate, delete, or extract victims' pages and trigger OCR.
Original NVD description (English source)
Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/{node_id} to grant themselves any role, then read, modify, or delete victims' documents and revoke existing shares.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS