CVE-2026-48052
Received Received - Intake

Authenticated User Tag Deletion in Papra Platform

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: GitHub, Inc.

Description
Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, an authenticated user who is a member of any organization can delete or rename tags belonging to a different organization, given the target tag's ID. The route handler verifies the caller's membership of the ":organizationId" in the URL, but the repository write filters on tag.id alone, so the URL-level org scope never reaches the database. This issue has been patched in version 26.5.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-48052
EUVD
EUVD-2026-49391

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
papra document_management_and_archiving_platform to 26.5.0 (exc)
papra papra to 26.5.0 (exc)
papra papra 26.5.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Papra (versions <= 26.4.0) allows an authenticated user in any organization to delete or rename tags belonging to a different organization. The issue occurs because the system checks the user's membership in the URL's organization ID but fails to enforce this at the database level. Attackers can exploit this by knowing a target tag's 24-character ID, which may be obtained through logs, exports, or backups.

Impact Analysis

An attacker could delete or modify tags in another organization, causing data integrity issues or disruptions. This might lead to documents losing tags, incorrect tag associations, or errors in tag operations. However, the vulnerability does not allow reading data, creating tags, or affecting tags without known IDs.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized modification or deletion of tags across organizations. If exploited, it may lead to unauthorized changes in document metadata, which could affect data integrity and access controls required by these regulations.

Mitigation Strategies

Upgrade Papra to version 26.5.0 or later to patch the vulnerability. Ensure all instances are updated to prevent unauthorized tag modifications across organizations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48052. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart