Unauthorized Document Access in Papermerge Core

Executive Summary

CVE-2026-110623 is a missing authorization vulnerability in Papermerge Core through version 3.5.3. It allows authenticated users to share other users' documents by providing arbitrary node UUIDs. Attackers can exploit this by calling POST /shared-nodes or PATCH /shared-nodes/access/{node_id} to assign themselves any role, enabling them to read, modify, or delete victims' documents and revoke existing shares.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor API logs for unusual POST or PATCH requests to /shared-nodes or /shared-nodes/access/{node_id} endpoints. Check for requests where users assign themselves roles on nodes not owned by them. Review authentication logs for suspicious activity patterns.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with authenticated access to gain unauthorized control over documents belonging to other users. They can read, modify, or delete sensitive documents and revoke existing sharing permissions, potentially leading to data breaches, loss of confidentiality, or disruption of document management operations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can lead to unauthorized access and disclosure of sensitive data, violating GDPR's data protection principles and HIPAA's confidentiality requirements. Organizations using Papermerge Core may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Papermerge Core to the latest version beyond 3.5.3. Review and restrict API access permissions. Implement additional authorization checks for shared nodes endpoints. Monitor for unauthorized document access or modifications.

Useful 0 Not Useful 0