CVE-2026-111350

Received Received - Intake

Authenticated Users Can Delete Viewer Groups in Papermark

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

Papermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer group API that allows authenticated users to delete other teams' viewer groups and share links. Attackers who know a victim team's data room and group identifiers can send DELETE requests, read group links, or rewrite group document permissions across teams.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-111350

Affected Vendors & Products

Vendor	Product	Version / Range
papermark	Papermark	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in Papermark through 0.22.0 allows authenticated users to delete other teams' viewer groups and share links without proper authorization. Attackers can exploit this by knowing a victim team's data room and group identifiers to send DELETE requests, read group links, or modify document permissions across teams.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized DELETE requests or modifications to viewer groups and share links in Papermark. Monitor API logs for suspicious DELETE requests targeting /api/data-rooms/{roomId}/viewer-groups/{groupId} or similar endpoints. Check for unexpected changes in document permissions or group links across teams.

Impact Analysis

This vulnerability can lead to unauthorized access and deletion of sensitive data, loss of control over shared documents, and potential exposure of confidential information across teams. It undermines data integrity and confidentiality for all users.

Compliance Impact

This vulnerability can violate compliance requirements such as GDPR and HIPAA by enabling unauthorized access to sensitive data, leading to potential data breaches and non-compliance with privacy and security standards.

Mitigation Strategies

Immediately update Papermark to the latest version beyond 0.22.0. Review and restrict API access permissions for all users, ensuring only authorized personnel can modify viewer groups. Audit existing viewer groups and share links for unauthorized changes. Implement network-level monitoring to detect and block suspicious DELETE requests targeting Papermark APIs.

Hi! I’m here to help you understand CVE-2026-111350. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70