CVE-2026-110623

Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/nodeid to grant themselves an...

CVE-2026-110624

Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by supplying a groupid parameter. Attackers who know a group's UUID can query GET /tags/all or GET /document-types/all, which skip the...

CVE-2026-110622

Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip hasnodeperm checks. Attackers knowing page UUIDs can call /pages/, /pages/move, or /pages/extract to rotate,...

CVE-2026-110624

Papermerge Core versions through 3.5.3 are vulnerable to a missing authorization flaw (CWE-862). The issue exists because the GET /tags/all and GET /document-types/all endpoints fail to perform the necessary user_belongs_to check when a group_id parameter is supplied. Consequently, authenticated ...

EUVD-2026-101252

Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by supplying a groupid parameter. Attackers who know a group's UUID can query GET /tags/all or GET /document-types/all, which skip the...

CVE-2026-110624 Papermerge Core through 3.5.3 Missing Authorization via /tags/all and /document-types/all

Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by supplying a groupid parameter. Attackers who know a group's UUID can query GET /tags/all or GET /document-types/all, which skip the...

CVE-2026-110623 Papermerge Core through 3.5.3 Missing Authorization in Shared Nodes API

Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/nodeid to grant themselves an...

CVE-2026-110623

Papermerge Core versions up to and including 3.5.3 are vulnerable to a missing authorization flaw in the shared nodes API . By supplying arbitrary node UUIDs, authenticated users can exploit the POST /shared-nodes or PATCH /shared-nodes/access/{node_id} endpoints to grant themselves roles over ot...

CVE-2026-110622

The Papermerge Core software (through version 3.5.3 ) is vulnerable to a missing authorization flaw in its page management and OCR endpoints. The root cause is that these endpoints fail to perform necessary has_node_perm checks, allowing authenticated users to access and manipulate data belonging...

EUVD-2026-101251

Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/nodeid to grant themselves an...

CVE-2026-110622 Papermerge Core through 3.5.3 Missing Authorization in Page Management and OCR Endpoints

Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip hasnodeperm checks. Attackers knowing page UUIDs can call /pages/, /pages/move, or /pages/extract to rotate,...

EUVD-2026-101250

Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip hasnodeperm checks. Attackers knowing page UUIDs can call /pages/, /pages/move, or /pages/extract to rotate,...

WS-2021-0502

Papermerge and Papermerge-core are vulnerable to stored XSS in search results. An attacker uploads a malicious file which contains XSS payloads and shares it with users or admins can achieve remote code execution...