CVE-2026-120463 in Warracker
Summary
by MITRE • 11/02/2026
Warracker before 1.0.4 contains a missing authorization vulnerability in its Paperless-ngx integration that allows an authenticated, non-administrative user to bypass document ownership restrictions by searching for and linking another user's private document ID to a warranty they own using the `other` document type. Attackers can exploit insufficient authorization checks in the `paperless_search_and_link()` and `serve_paperless_document()` route handlers in file_routes.py to retrieve and disclose private documents belonging to another user via the shared Paperless-ngx API credential, resulting in unauthorized read access and confidentiality loss.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified in Warracker versions prior to 1.0.4 represents a critical failure in authorization logic within its integration with the Paperless-ngx document management system. This flaw specifically affects authenticated users who do not possess administrative privileges, allowing them to circumvent standard ownership restrictions imposed on private documents. The core of the issue lies in how the application handles requests related to linking warranty records to external digital assets managed by Paperless-ngx. By exploiting insufficient authorization checks within specific route handlers, an attacker can manipulate the system into associating a document owned by another user with their own warranty record, thereby gaining indirect access to sensitive information that should remain strictly confidential and isolated from unauthorized parties.
The technical mechanism of this exploitation centers on two primary functions located in the file_routes.py module: paperless_search_and_link() and serve_paperless_document(). When an authenticated non-administrative user initiates a search for documents, they can specify document types including those designated as private to other users. The application fails to verify whether the requesting user has legitimate ownership or explicit permission to access the targeted document ID before proceeding with the linkage operation. Furthermore, when serving these documents, the system relies on shared API credentials associated with the Paperless-ngx integration rather than enforcing per-user token validation for individual file retrieval. This architectural oversight means that once a private document is linked via the other document type mechanism, any authenticated user can subsequently retrieve and view its contents through the serve_paperless_document endpoint without encountering access denials or permission errors.
From an operational impact perspective, this vulnerability leads to a significant loss of confidentiality for organizations utilizing Warracker in conjunction with Paperless-ngx. Sensitive documents such as personal identification records, financial statements, legal contracts, or proprietary business information belonging to one user can be read by any other authenticated user within the same instance. This unauthorized access violates fundamental data privacy principles and may result in regulatory non-compliance depending on the nature of the exposed data and applicable laws such as GDPR or HIPAA. The ability to bypass ownership restrictions undermines trust in the system's security model, potentially leading to reputational damage and legal liabilities for both the software provider and its customers who rely on strict access controls to protect sensitive information assets.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, specifically where a user is able to perform actions beyond their assigned privileges due to flawed authorization logic. Additionally, it maps to MITRE ATT&CK technique T1078, Valid Accounts, as the exploitation requires valid authentication credentials but abuses them to access resources outside of normal operational boundaries. The specific behavior of linking and retrieving foreign documents also reflects aspects of CWE-284, Improper Access Control, where security restrictions are not correctly enforced during resource access operations.
To mitigate this vulnerability, organizations must upgrade Warracker to version 1.0.4 or later, which addresses the authorization gaps in the specified route handlers. In environments where immediate patching is not feasible, administrators should implement strict network-level controls to limit access to the application interface and ensure that only trusted users have authenticated accounts. Additionally, reviewing API credential management practices within the Paperless-ngx integration can help reduce risk; while shared credentials are common for service-to-service communication, ensuring that downstream applications enforce granular permission checks before exposing data is crucial. Regular security audits focusing on authorization logic in file handling modules and implementing principle of least privilege across all user roles will further strengthen defenses against similar access control bypasses.