CVE-2026-110622
CVE-2026-110622 · Papermerge Core through 3.5.3 Missing Authorization in Page Management and OCR Endpoints
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip has_node_perm checks. Attackers knowing page UUIDs can call /pages/, /pages/move, or /pages/extract to rotate, delete, or extract victims' pages, and trigger OCR via /tasks/ocr.
CVSS 7.7 · Alta · EPSS 0,5%
- Publicación
- Actualización
Productos y versiones afectados
papermerge-core
- Versiones
- ≥ 0, ≤ 3.5.3: Afectada (semver)
Sin corrección publicada
Fuentes originales
- https://github.com/papermerge/papermerge-core/issues/1290
- https://github.com/papermerge/papermerge-core/blob/3.5.3/papermerge/core/features/document/router_pages.py#L29-L131
- https://github.com/papermerge/papermerge-core/blob/3.5.3/papermerge/core/features/tasks/router.py#L17-L35
- https://github.com/papermerge/papermerge-core/commit/6ad2836dc40b61bd032146013272036bbece6144
- https://www.vulncheck.com/advisories/papermerge-core-through-3.5.3-missing-authorization-in-page-management-and-ocr-endpoints
- https://nvd.nist.gov/vuln/detail/CVE-2026-110622