CVE-2026-110622: fallo de gravedad alta en papermerge-core
Papermerge Core through 3.5.3 Missing Authorization in Page Management and OCR Endpoints
Publicada el
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.7epss 0.5%
probabilidad de explotación
0.5%top 59% de las CVE
explotación observada
noninguna fuente lo reporta
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip has_node_perm checks. Attackers knowing page UUIDs can call /pages/, /pages/move, or /pages/extract to rotate, delete, or extract victims' pages, and trigger OCR via /tasks/ocr.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
papermerge · papermerge-coreCVEs relacionadas — papermerge-core
En el mismo producto, de las más peligrosas a las menos.
Referencias
https://github.com/papermerge/papermerge-core/blob/3.5.3/papermerge/core/features/document/router_pages.py#L29-L131https://github.com/papermerge/papermerge-core/blob/3.5.3/papermerge/core/features/tasks/router.py#L17-L35https://github.com/papermerge/papermerge-core/commit/6ad2836dc40b61bd032146013272036bbece6144https://github.com/papermerge/papermerge-core/issues/1290https://www.vulncheck.com/advisories/papermerge-core-through-3.5.3-missing-authorization-in-page-management-and-ocr-endpoints