CVE-2026-110623
CVE-2026-110623 · Papermerge Core through 3.5.3 Missing Authorization in Shared Nodes API
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/{node_id} to grant themselves any role, then read, modify, or delete victims' documents and revoke existing shares.
CVSS 7.7 · Alta · EPSS 0,5%
- Publicación
- Actualización
Productos y versiones afectados
papermerge-core
- Versiones
- ≥ 0, ≤ 3.5.3: Afectada (semver)
Sin corrección publicada
Fuentes originales
- https://github.com/papermerge/papermerge-core/issues/1290
- https://github.com/papermerge/papermerge-core/issues/1291
- https://github.com/papermerge/papermerge-core/blob/3.5.3/papermerge/core/features/shared_nodes/router.py#L78-L150
- https://github.com/papermerge/papermerge-core/commit/0fd469102b05b5ebeb5ee39b3f73ff76991ab269
- https://www.vulncheck.com/advisories/papermerge-core-through-3.5.3-missing-authorization-in-shared-nodes-api
- https://nvd.nist.gov/vuln/detail/CVE-2026-110623