CVE-2026-120463

Warracker versions before 1.0.4 contain a missing authorization vulnerability within its Paperless-ngx integration. The root cause is insufficient authorization checks in the paperless_search_and_link() and serve_paperless_document() route handlers located in file_routes.py. This flaw allows an a...

EUVD-2026-115152

Warracker before 1.0.4 contains a missing authorization vulnerability in its Paperless-ngx integration that allows an authenticated, non-administrative user to bypass document ownership restrictions by searching for and linking another user's private document ID to a warranty they own using the...