CVE-2026-110624 in Papermerge
Summary
by MITRE • 10/15/2026
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by supplying a group_id parameter. Attackers who know a group's UUID can query GET /tags/all or GET /document-types/all, which skip the user_belongs_to check, to disclose metadata of groups they do not belong to.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
Papermerge Core versions through 3.5.3 are affected by an insecure direct object reference vulnerability that permits authenticated users to access sensitive metadata belonging to other organizational groups. This flaw stems from a failure in the application logic to properly validate whether the requesting user has membership within the group identified by the supplied identifier. Specifically, when interacting with endpoints such as GET /tags/all or GET /document-types/all, the backend implementation accepts an arbitrary group_id parameter without verifying that the authenticated session belongs to that specific group context. This oversight allows any valid user who possesses knowledge of a target group's universally unique identifier to bypass standard access controls and retrieve data intended for internal use within that separate entity.
The technical root cause lies in the absence of a critical authorization check, often referred to as an object level permission failure or improper privilege management. In secure implementations, API endpoints handling resources associated with specific organizational units must ensure that the current user's identity is linked to those units before returning data. Here, the application logic skips this verification step entirely for these particular routes. Consequently, if an attacker can enumerate or guess a group UUID, they can construct requests that return comprehensive lists of tags and document types defined by other groups. This behavior violates the principle of least privilege and fails to enforce proper isolation between distinct tenant or departmental data sets within the multi-tenant architecture.
The operational impact of this vulnerability is significant for organizations relying on Papermerge for secure document management, particularly in environments where multiple departments or external partners share a single instance with strict data separation requirements. The disclosed metadata includes tags and document types which may reveal sensitive information about internal processes, project classifications, regulatory compliance categories, or proprietary workflows. While the attack does not directly expose the content of stored documents, it provides attackers with valuable intelligence that can facilitate further reconnaissance. Knowledge of specific tag structures or document type definitions can aid in crafting more targeted attacks against other components of the system or help identify high-value targets for subsequent exploitation attempts.
This vulnerability aligns closely with CWE-284, which covers Improper Access Control, and specifically relates to CWE-639 regarding Authorization Bypass Through User-Controlled Key. In terms of offensive security frameworks, this behavior is characteristic of ATT&CK technique T1078, Valid Accounts, where an attacker leverages legitimate credentials to access resources they are not authorized to view. The exploitation path also reflects aspects of T1530, Data from Local System, as the attacker extracts structured data about local organizational configurations rather than raw file contents.
To mitigate this risk, administrators should immediately upgrade Papermerge Core to version 3.5.4 or later where these authorization checks have been corrected. Until an update is applied, it is advisable to restrict access to the application through network-level controls such as firewalls or reverse proxies that limit exposure to trusted IP ranges only. Additionally, implementing strict input validation on all API endpoints and conducting a code review focused on object-level permissions can help prevent similar issues in custom integrations or future development cycles. Regular security audits should include testing for broken access control flaws by attempting to manipulate identifiers like group IDs during authenticated sessions to ensure that data isolation mechanisms are functioning as intended across the entire platform.