CVE-2026-110622
CVE-2026-110622 · Papermerge Core through 3.5.3 Missing Authorization in Page Management and OCR Endpoints
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip has_node_perm checks. Attackers knowing page UUIDs can call /pages/, /pages/move, or /pages/extract to rotate, delete, or extract victims' pages, and trigger OCR via /tasks/ocr.
CVSS 7.7 · Hoch · EPSS 0,5%
- Veröffentlicht
- Aktualisiert
Betroffene Produkte und Versionen
papermerge-core
- Softwareversionen
- ≥ 0, ≤ 3.5.3: Betroffen (semver)
Keine Korrektur veröffentlicht
Originalquellen
- https://github.com/papermerge/papermerge-core/issues/1290
- https://github.com/papermerge/papermerge-core/blob/3.5.3/papermerge/core/features/document/router_pages.py#L29-L131
- https://github.com/papermerge/papermerge-core/blob/3.5.3/papermerge/core/features/tasks/router.py#L17-L35
- https://github.com/papermerge/papermerge-core/commit/6ad2836dc40b61bd032146013272036bbece6144
- https://www.vulncheck.com/advisories/papermerge-core-through-3.5.3-missing-authorization-in-page-management-and-ocr-endpoints
- https://nvd.nist.gov/vuln/detail/CVE-2026-110622