CVE-2026-48052

MediumCVSS 5.4

Published: 27/07/2026(UTC)Updated: 30/07/2026(UTC)Translated: 28/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

12th percentile - higher than 12% of all known CVEs

Summary

In Papra prior to version 26.5.0, an authenticated user who is a member of any organization can delete or rename tags belonging to a different organization, given the target tag's ID. The access control checks organization membership at the URL level, but the database query filters only by tag ID, bypassing the organization scope.

Risk Assessment

An attacker can compromise the data integrity of other organizations by deleting or modifying their tags, potentially leading to workflow disruption and data loss.

Recommendation

Immediately update Papra to version 26.5.0 or later, which contains the fix for this vulnerability.

Other vulnerabilities in Papra

CVE-2026-48051Low
In Papra prior to version 26.5.0, the webhook delivery system contains an SSRF protection bypass that allows any authenticated organisation member to cause the server to make HTTP requests to internal addresses (loopback, link-local, RFC-1918 ranges). The SSRF protection validates the registered webhook URL but ignores redirect destinations. The HTTP client (ofetch) follows 3xx responses automatically, and the redirect target is never checked against the blocklist.

Original NVD description (English source)

Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, an authenticated user who is a member of any organization can delete or rename tags belonging to a different organization, given the target tag's ID. The route handler verifies the caller's membership of the ":organizationId" in the URL, but the repository write filters on tag.id alone, so the URL-level org scope never reaches the database. This issue has been patched in version 26.5.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS