CVE-2026-110623 in Papermerge
Summary
by MITRE • 10/14/2026
Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/{node_id} to grant themselves any role, then read, modify, or delete victims' documents and revoke existing shares.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in Papermerge Core versions up to 3.5.3 represents a critical failure in access control mechanisms within the shared nodes API. This flaw is classified as an Insecure Direct Object Reference (IDOR), corresponding to CWE-639, where the application fails to verify that the authenticated user has permission to perform actions on specific resources identified by their unique identifiers. Specifically, the vulnerability exists because the backend logic does not validate whether the node UUID provided in API requests belongs to a document owned or shared with the requesting user. This lack of server-side authorization checks allows any authenticated account to bypass intended access restrictions and manipulate documents belonging to other users within the system.
The technical exploitation of this flaw involves interacting directly with two specific endpoints: POST /shared-nodes and PATCH /shared-nodes/access/{node_id}. By supplying arbitrary node UUIDs that correspond to documents owned by other users, an attacker can inject themselves into the sharing permissions list for those documents. The vulnerability allows the attacker to assign any role or permission level to their own account regarding these foreign resources. This capability effectively grants the attacker full administrative control over victim-owned content without requiring prior authorization from the document owner.
The operational impact of this vulnerability is severe, encompassing a complete compromise of data confidentiality, integrity, and availability for affected users. Once an attacker has granted themselves elevated permissions on a target node, they can read sensitive documents that were intended to be private or restricted to specific collaborators. Furthermore, the ability to modify these documents allows for potential data tampering or corruption, while the capacity to delete them results in permanent loss of information. Additionally, attackers can revoke existing shares held by legitimate users, effectively locking out owners and other authorized parties from accessing their own files. This level of control undermines the fundamental trust model of a document management system where isolation between user workspaces is paramount.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK techniques related to unauthorized access and privilege escalation within cloud applications or distributed systems. The attack vector leverages API manipulation rather than traditional network exploitation, highlighting the importance of securing application-layer interfaces against logic flaws that do not rely on input validation errors but rather on business logic enforcement failures. Such vulnerabilities are particularly dangerous because they often evade standard perimeter defenses like firewalls and intrusion detection systems, as the traffic appears to be legitimate authenticated user activity.
Mitigation strategies must focus primarily on immediate patching of Papermerge Core to version 3.5.4 or later, where this authorization check has been corrected. In environments where upgrading is not immediately feasible, administrators should implement strict input validation and access control checks at the API gateway level if possible, though server-side fixes are required for a complete resolution. Developers must ensure that all endpoints handling resource identifiers perform rigorous ownership verification before executing any state-changing operations. This includes validating that the current user session has explicit permission to modify sharing settings for the specific node UUID being targeted. Regular security audits of API logic and implementation of automated testing suites that include authorization bypass scenarios are recommended to prevent similar flaws in future development cycles.