CVE-2026-110624

Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by supplying a group_id parameter. Attackers who know a group's UUID can query GET /tags/all or GET /document-types/all, which skip the user_belongs_to check, to disclose metadata of groups they do not belong to.

An authenticated attacker can obtain metadata of tags and document types belonging to other groups, resulting in information disclosure. The risk affects organizations using Papermerge Core with multiple groups.

Update Papermerge Core to a version newer than 3.5.3 once a fix is available. Until then, consider restricting access to the /tags/all and /document-types/all endpoints.