CVE-2026-110622: Papermerge Core through 3.5.3 Missing Authorization in Page Management and OCR Endpoints
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip hasnodeperm checks. Attackers knowing page UUIDs can call /pages/, /pages/move, or /pages/extract to rotate, delete, or extract victims' pages, and trigger OCR via /tasks/ocr.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Papermerge Core user can exploit it if they know the UUIDs of another user's pages. The affected page-management and OCR endpoints do not perform the expected has_node_perm authorization checks.
What actions can an attacker take?
An attacker can use /pages/, /pages/move, or /pages/extract to rotate, delete, move, or extract another user's pages. They can also trigger OCR through /tasks/ocr.
Are unauthenticated attackers affected?
The described attack requires authentication and knowledge of victim page UUIDs. The provided information does not indicate that these endpoints are exploitable without an authenticated account.
How can I determine whether my deployment is affected?
Papermerge Core through version 3.5.3 is affected. Review whether authenticated users can reach the listed endpoints and whether requests against page UUIDs belonging to other users succeed without a has_node_perm authorization check.