CVE-2026-110624

Deferred Deferred - Pending Action

Authenticated Group Metadata Exposure in Papermerge Core

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by supplying a group_id parameter. Attackers who know a group's UUID can query GET /tags/all or GET /document-types/all, which skip the user_belongs_to check, to disclose metadata of groups they do not belong to.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110624

EUVD

EUVD-2026-101252

Affected Vendors & Products

Vendor	Product	Version / Range
papermerge	papermerge-core	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in Papermerge Core through 3.5.3 allows authenticated users to list tags and document types belonging to other groups by supplying a group_id parameter. The GET /tags/all and GET /document-types/all endpoints fail to verify if the requesting user belongs to the specified group, bypassing intended access controls.

Detection Guidance

To detect this vulnerability, check if authenticated users can access GET /tags/all or GET /document-types/all endpoints with a group_id parameter and retrieve data from unauthorized groups. Monitor logs for unauthorized access attempts or unexpected API responses from these endpoints.

Impact Analysis

An attacker with knowledge of a group's UUID could exploit this to access metadata of groups they do not belong to. This may lead to unauthorized disclosure of sensitive information such as document types or tags used by other groups.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by allowing unauthorized access to sensitive metadata of groups that users do not belong to. Unauthorized disclosure of group information may lead to breaches of confidentiality requirements under these regulations.

Mitigation Strategies

Apply the latest security patches or updates to Papermerge Core to fix the authorization bypass in GET /tags/all and GET /document-types/all endpoints. Ensure proper group membership validation is enforced before allowing access to these resources.

Hi! I’m here to help you understand CVE-2026-110624. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70