CVE-2026-110623highCWE-862

CVE-2026-110623: falha de alta gravidade em papermerge-core

Papermerge Core through 3.5.3 Missing Authorization in Shared Nodes API

Publicada em

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.7epss 0.5%
probabilidade de exploração
0.5%top 59% das CVEs
exploração observada
nãonenhuma fonte reporta
Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/{node_id} to grant themselves any role, then read, modify, or delete victims' documents and revoke existing shares.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
papermerge · papermerge-core
CVEs relacionadas — papermerge-core

No mesmo produto, das mais perigosas para as menos.

CVE-2026-110622HIGHPapermerge Core through 3.5.3 Missing Authorization in Page Management and OCR EndpointsEPSS 0.5%CVE-2026-110624LOWPapermerge Core through 3.5.3 Missing Authorization via /tags/all and /document-types/allEPSS 0.3%
Referências
https://github.com/papermerge/papermerge-core/blob/3.5.3/papermerge/core/features/shared_nodes/router.py#L78-L150https://github.com/papermerge/papermerge-core/commit/0fd469102b05b5ebeb5ee39b3f73ff76991ab269https://github.com/papermerge/papermerge-core/issues/1290https://github.com/papermerge/papermerge-core/issues/1291https://www.vulncheck.com/advisories/papermerge-core-through-3.5.3-missing-authorization-in-shared-nodes-api