CVE-2026-110624: Papermerge Core through 3.5.3 Missing Authorization via /tags/all and /document-types/all
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by supplying a groupid parameter. Attackers who know a group's UUID can query GET /tags/all or GET /document-types/all, which skip the userbelongsto check, to disclose metadata of groups they do not belong to.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Papermerge Core user can exploit it against groups they do not belong to, provided they know the target group's UUID. The affected endpoints are /tags/all and /document-types/all.
What does an attacker need to send a request?
The attacker needs valid authentication and a group_id parameter containing another group's UUID. Exploitation uses GET requests to the affected endpoints.
What is exposed if exploitation succeeds?
The issue discloses metadata about another group's tags and document types. The supplied information does not indicate data modification or service disruption.