CVE-2026-110622: falha de alta gravidade em papermerge-core
Papermerge Core through 3.5.3 Missing Authorization in Page Management and OCR Endpoints
Publicada em
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.7epss 0.5%
probabilidade de exploração
0.5%top 59% das CVEs
exploração observada
nãonenhuma fonte reporta
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip has_node_perm checks. Attackers knowing page UUIDs can call /pages/, /pages/move, or /pages/extract to rotate, delete, or extract victims' pages, and trigger OCR via /tasks/ocr.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
papermerge · papermerge-coreCVEs relacionadas — papermerge-core
No mesmo produto, das mais perigosas para as menos.
Referências
https://github.com/papermerge/papermerge-core/blob/3.5.3/papermerge/core/features/document/router_pages.py#L29-L131https://github.com/papermerge/papermerge-core/blob/3.5.3/papermerge/core/features/tasks/router.py#L17-L35https://github.com/papermerge/papermerge-core/commit/6ad2836dc40b61bd032146013272036bbece6144https://github.com/papermerge/papermerge-core/issues/1290https://www.vulncheck.com/advisories/papermerge-core-through-3.5.3-missing-authorization-in-page-management-and-ocr-endpoints