CVE-2026-110623highCWE-862

CVE-2026-110623: fallo de gravedad alta en papermerge-core

Papermerge Core through 3.5.3 Missing Authorization in Shared Nodes API

Publicada el

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.7epss 0.5%
probabilidad de explotación
0.5%top 59% de las CVE
explotación observada
noninguna fuente lo reporta
Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/{node_id} to grant themselves any role, then read, modify, or delete victims' documents and revoke existing shares.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
papermerge · papermerge-core
CVEs relacionadas — papermerge-core

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-110622HIGHPapermerge Core through 3.5.3 Missing Authorization in Page Management and OCR EndpointsEPSS 0.5%CVE-2026-110624LOWPapermerge Core through 3.5.3 Missing Authorization via /tags/all and /document-types/allEPSS 0.3%
Referencias
https://github.com/papermerge/papermerge-core/blob/3.5.3/papermerge/core/features/shared_nodes/router.py#L78-L150https://github.com/papermerge/papermerge-core/commit/0fd469102b05b5ebeb5ee39b3f73ff76991ab269https://github.com/papermerge/papermerge-core/issues/1290https://github.com/papermerge/papermerge-core/issues/1291https://www.vulncheck.com/advisories/papermerge-core-through-3.5.3-missing-authorization-in-shared-nodes-api