Papermerge Core vulnerabilities

Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by supplying a group_id parameter. Attackers who know a group's UUID can query GET /tags/all or GET /document-types/all, which skip the user_belongs_to check, to disclose metadata of groups they do not belong to.

Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API. Authenticated users can share other users' documents by supplying arbitrary node UUIDs, then read, modify, or delete victims' documents and revoke existing shares.

Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip has_node_perm checks. Attackers knowing page UUIDs can rotate, delete, or extract victims' pages and trigger OCR.