CVE-2026-110623: Papermerge Core through 3.5.3 Missing Authorization in Shared Nodes API
Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/{nodeid} to grant themselves any role, then read, modify, or delete victims' documents and revoke existing shares.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need before attempting exploitation?
The attacker needs an authenticated Papermerge account and a target document node UUID. They do not need legitimate access to the victim's document if they can supply its UUID to the affected shared-nodes API.
Can a low-privileged user escalate their access to another user's document?
Yes. An authenticated user can use the affected API to grant themselves any role for an arbitrary node UUID, enabling access beyond their intended permissions.
What activity should be investigated for possible exploitation?
Investigate requests to POST /shared-nodes and PATCH /shared-nodes/access/{node_id}, especially where the requester was granted a role on a node they did not previously own or have access to. Also review affected documents for unauthorized reads, modifications, deletions, or revoked existing shares.