CVE-2026-110622: high-severity vulnerability in papermerge-core
Papermerge Core through 3.5.3 Missing Authorization in Page Management and OCR Endpoints
Published
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.7epss 0.5%
exploitation probability
0.5%top 59% of all CVEs
observed exploitation
nono source reports it
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip has_node_perm checks. Attackers knowing page UUIDs can call /pages/, /pages/move, or /pages/extract to rotate, delete, or extract victims' pages, and trigger OCR via /tasks/ocr.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
papermerge · papermerge-coreRelated CVEs — papermerge-core
In the same product, most dangerous first.
References
https://github.com/papermerge/papermerge-core/blob/3.5.3/papermerge/core/features/document/router_pages.py#L29-L131https://github.com/papermerge/papermerge-core/blob/3.5.3/papermerge/core/features/tasks/router.py#L17-L35https://github.com/papermerge/papermerge-core/commit/6ad2836dc40b61bd032146013272036bbece6144https://github.com/papermerge/papermerge-core/issues/1290https://www.vulncheck.com/advisories/papermerge-core-through-3.5.3-missing-authorization-in-page-management-and-ocr-endpoints