CVE-2026-111350 in Papermark
Summary
by MITRE • 10/16/2026
Papermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer group API that allows authenticated users to delete other teams' viewer groups and share links. Attackers who know a victim team's data room and group identifiers can send DELETE requests, read group links, or rewrite group document permissions across teams.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/16/2026
The identified security flaw resides within the Papermark application, specifically affecting versions up to 0.22.0 in its data room viewer group API functionality. This vulnerability is classified as a missing authorization issue, which fundamentally represents an access control failure where the system fails to properly verify that an authenticated user has permission to perform actions on resources belonging to other entities. In this specific context, the application does not adequately validate whether the requesting user owns or has administrative rights over the data room and viewer group identified in the API request parameters. Consequently, any authenticated user who can guess or obtain valid identifiers for a target team's data room and associated groups can interact with those resources without proper permission checks.
From a technical perspective, this flaw allows attackers to execute destructive and intrusive operations against other teams' infrastructure. By sending DELETE requests to the relevant API endpoints, an attacker can remove viewer groups that were intended to restrict access to sensitive documents within a data room. Furthermore, the vulnerability permits the reading of group links, which may expose internal sharing mechanisms or confidential pathways to unauthorized parties. Additionally, attackers are able to rewrite document permissions for these groups, potentially granting themselves or other malicious actors elevated access levels to restricted files and datasets. This lack of object-level authorization control means that resource identifiers serve as sufficient authentication vectors if known by an adversary, bypassing the intended security boundaries between different organizational teams using the platform.
The operational impact of this vulnerability is severe for organizations relying on Papermark for secure document sharing and collaboration. The ability to delete viewer groups disrupts business continuity and can lead to accidental exposure or loss of access control configurations managed by legitimate administrators. More critically, the capability to read group links and modify permissions poses a significant risk to data confidentiality and integrity. Sensitive corporate documents could be exposed to unauthorized individuals if link information is leaked, while permission changes could allow attackers to escalate their privileges within specific data rooms, leading to potential intellectual property theft or manipulation of critical business records. This undermines the trust model inherent in multi-tenant SaaS applications where isolation between tenant teams is paramount for security and compliance.
This vulnerability aligns with CWE-284, which describes Improper Access Control, specifically highlighting failures in verifying user authorization before performing actions on specific objects. It also maps to MITRE ATT&CK technique T1078, Valid Accounts, as the exploitation relies on existing authenticated credentials rather than credential theft or injection attacks. To mitigate this risk, immediate updates to Papermark beyond version 0.22.0 are recommended if a patch has been released by the vendor. In the interim, administrators should enforce strict API access controls and monitor for unusual DELETE requests or permission modifications originating from unexpected user accounts. Implementing robust input validation that cross-references request parameters with user ownership metadata is essential to prevent such authorization bypasses in future development cycles.