CVE-2026-48052 in papra
Summary
by MITRE • 07/27/2026
Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, an authenticated user who is a member of any organization can delete or rename tags belonging to a different organization, given the target tag's ID. The route handler verifies the caller's membership of the ":organizationId" in the URL, but the repository write filters on tag.id alone, so the URL-level org scope never reaches the database. This issue has been patched in version 26.5.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/27/2026
This vulnerability represents a critical access control flaw in the Papra document management platform that enables privilege escalation through improper authorization checks. The issue stems from a fundamental mismatch between the application's security model and its implementation, creating an avenue for authenticated users to manipulate resources belonging to other organizations. The vulnerability affects versions prior to 26.5.0 and demonstrates a classic case of insufficient authorization validation where the system performs checks at the wrong layer of the application architecture.
The technical flaw manifests in the route handler's inconsistent security approach where it properly validates the caller's organization membership against the organization ID present in the URL path but fails to enforce this scope when executing database operations. The repository layer only applies filtering based on tag.id without considering the organizational context that should have been established during the initial authorization check. This architectural gap creates a direct path for exploitation where an authenticated user can craft requests targeting specific tag IDs belonging to other organizations, bypassing the intended organizational boundaries.
The operational impact of this vulnerability is significant as it allows for unauthorized modification of critical metadata within foreign organizations' document management systems. An attacker with access to any organization's account could potentially disrupt document categorization and retrieval processes by deleting or renaming tags that belong to other organizations, leading to data integrity issues and potential information leakage. This type of cross-organization resource manipulation can severely compromise the confidentiality and availability of organizational data within the platform.
From a cybersecurity perspective, this vulnerability aligns with CWE-639 (Authorization Bypass Through User-Controlled Key) and represents an authorization bypass that violates the principle of least privilege. The flaw also maps to ATT&CK technique T1078.004 (Valid Accounts: Cloud Accounts) as it leverages legitimate user credentials to perform unauthorized actions within the platform's multi-tenant architecture. The issue demonstrates poor separation of concerns in the application's data access layer and highlights the importance of implementing consistent authorization checks across all system boundaries.
The mitigation strategy for this vulnerability involves ensuring that all database operations properly enforce organizational scope regardless of how the request originates. Version 26.5.0 addresses this by implementing proper validation that maintains the organization context established during URL path verification throughout the entire data access process. Organizations should implement comprehensive testing procedures to validate authorization boundaries, particularly in multi-tenant applications, and ensure that all repository-level operations respect the security contexts established at higher layers of the application architecture. Regular security audits of API endpoint implementations are essential to prevent similar issues where scope validation is applied inconsistently across different layers of the system.