CVE-2026-110622
CVE-2026-110622 · Papermerge Core through 3.5.3 Missing Authorization in Page Management and OCR Endpoints
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip has_node_perm checks. Attackers knowing page UUIDs can call /pages/, /pages/move, or /pages/extract to rotate, delete, or extract victims' pages, and trigger OCR via /tasks/ocr.
CVSS 7.7 · High · EPSS 0.5%
- Published
- Updated
Affected products and versions
papermerge-core
- Versions
- ≥ 0, ≤ 3.5.3: Affected (semver)
No fix published
Original sources
- https://github.com/papermerge/papermerge-core/issues/1290
- https://github.com/papermerge/papermerge-core/blob/3.5.3/papermerge/core/features/document/router_pages.py#L29-L131
- https://github.com/papermerge/papermerge-core/blob/3.5.3/papermerge/core/features/tasks/router.py#L17-L35
- https://github.com/papermerge/papermerge-core/commit/6ad2836dc40b61bd032146013272036bbece6144
- https://www.vulncheck.com/advisories/papermerge-core-through-3.5.3-missing-authorization-in-page-management-and-ocr-endpoints
- https://nvd.nist.gov/vuln/detail/CVE-2026-110622