28 matches found
CVE-2026-120463
Warracker before 1.0.4 contains a missing authorization vulnerability in its Paperless-ngx integration that allows an authenticated, non-administrative user to bypass document ownership restrictions by searching for and linking another user's private document ID to a warranty they own using the...
CVE-2026-120463
Warracker versions before 1.0.4 contain a missing authorization vulnerability within its Paperless-ngx integration. The root cause is insufficient authorization checks in the paperless_search_and_link() and serve_paperless_document() route handlers located in file_routes.py. This flaw allows an a...
CVE-2026-120463 Warracker before 1.0.4 Missing Authorization via Paperless-ngx Document Linking
Warracker before 1.0.4 contains a missing authorization vulnerability in its Paperless-ngx integration that allows an authenticated, non-administrative user to bypass document ownership restrictions by searching for and linking another user's private document ID to a warranty they own using the...
CVE-2026-120463
Warracker before 1.0.4 contains a missing authorization vulnerability in its Paperless-ngx integration that allows an authenticated, non-administrative user to bypass document ownership restrictions by searching for and linking another user's private document ID to a warranty they own using the...
EUVD-2026-115152
Warracker before 1.0.4 contains a missing authorization vulnerability in its Paperless-ngx integration that allows an authenticated, non-administrative user to bypass document ownership restrictions by searching for and linking another user's private document ID to a warranty they own using the...
CVE-2026-120463 Warracker before 1.0.4 Missing Authorization via Paperless-ngx Document Linking
Warracker before 1.0.4 contains a missing authorization vulnerability in its Paperless-ngx integration that allows an authenticated, non-administrative user to bypass document ownership restrictions by searching for and linking another user's private document ID to a warranty they own using the...
PT-2026-135432
Warracker before 1.0.4 contains a missing authorization vulnerability in its Paperless-ngx integration that allows an authenticated, non-administrative user to bypass document ownership restrictions by searching for and linking another user's private document ID to a warranty they own using the...
CVE-2026-120463: sassanix Warracker: Warracker before 1.0.4 contains a missing authorization vulnerability in its Paperless-ngx integration that allows an…
Warracker before 1.0.4 contains a missing authorization vulnerability in its Paperless-ngx integration that allows an authenticated, non-administrative user to bypass document ownership restrictions by searching for and linking another user's private document ID to a warranty they own using the...
Sassanix Warracker authorization issue vulnerability
Versions of Sassanix Warracker prior to 1.0.4 contain an authorization issue vulnerability. This vulnerability stems from a lack of authorization checks within the integration with Paperless-ngx. Authenticated non-administrator users can search for other document types and link private document I...
CVE-2026-71244
Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, accounttype, refreshtoken, and expiration from that existing account while allowing the caller to supply a different imapserver, imapport, and...
CVE-2026-71244
Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, accounttype, refreshtoken, and expiration from that existing account while allowing the caller to supply a different imapserver, imapport, and...
CVE-2026-71244
Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, accounttype, refreshtoken, and expiration from that existing account while allowing the caller to supply a different imapserver, imapport, and...
CVE-2026-71244 Paperless-ngx - Mail Account Test Connection Leaks Stored IMAP/OAuth Credentials to Attacker-Controlled Host
Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, accounttype, refreshtoken, and expiration from that existing account while allowing the caller to supply a different imapserver, imapport, and...
CVE-2026-71244 Paperless-ngx - Mail Account Test Connection Leaks Stored IMAP/OAuth Credentials to Attacker-Controlled Host
Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, accounttype, refreshtoken, and expiration from that existing account while allowing the caller to supply a different imapserver, imapport, and...
CVE-2026-71244 Paperless-ngx - Mail Account Test Connection Leaks Stored IMAP/OAuth Credentials to Attacker-Controlled Host
Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, accounttype, refreshtoken, and expiration from that existing account while allowing the caller to supply a different imapserver, imapport, and...
CVE-2026-71244: Server-Side Request Forgery (SSRF)
Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, accounttype, refreshtoken, and expiration from that existing account while allowing the caller to supply a different imapserver, imapport, and...
PT-2026-68110
Name of the Vulnerable Software and Affected Versions Paperless-ngx affected versions not specified Description An issue exists in the MailAccountViewSet.test action. When this action is called using an existing account ID and a masked password field, the system reuses the stored password, accoun...
Paperless-ngx Panel - Detect
Detected Paperless-ngx was a self-hosted document management platform for scanning, OCR-ing and tagging paper documents. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Paperless-ngx was a self-hosted document management platform for scanning, OCR-ing and tagging paper .""" from kittysploit...
CVE-2024-35184
Paperless-ngx is a document management system that transforms physical documents into a searchable online archive. Starting in version 2.5.0 and prior to version 2.8.6, remote user authentication allows API access even if API access is explicitly disabled. Version 2.8.6 contains a patchc for the...
CVE-2024-35184
Paperless-ngx is a document management system that transforms physical documents into a searchable online archive. Starting in version 2.5.0 and prior to version 2.8.6, remote user authentication allows API access even if API access is explicitly disabled. Version 2.8.6 contains a patchc for the...