CVE-2026-111350: Papermark through 0.22.0 Missing Authorization in Data Room Viewer Group API
Papermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer group API that allows authenticated users to delete other teams' viewer groups and share links. Attackers who know a victim team's data room and group identifiers can send DELETE requests, read group links, or rewrite group document permissions across teams.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Papermark user can exploit it. The attacker also needs to know the target team's data room and viewer group identifiers.
What actions can an attacker perform against another team's viewer groups?
An attacker can send DELETE requests to remove viewer groups and share links. They may also read group links or rewrite group document permissions across teams.
Are deployments running version 0.22.0 affected?
Yes. The issue is reported in Papermark through version 0.22.0, so version 0.22.0 is within the affected range.