CVE-2026-71244: Paperless-ngx: Mail Account Test Connection Leaks Stored IMAP/OAuth Credentials to Attacker-Controlled Host
Paperless-ngx's MailAccountViewSet.test() action, when called with an existing account's ID and a masked password field, reuses the stored password, accounttype, refreshtoken, and expiration from that existing account while allowing the caller to supply a different imapserver, imapport, and imapsecurity in the same request. The test connection then authenticates to the caller-specified server using the real stored credentials. A user holding only object-level changemailaccount permission on the target account (not full admin) can redirect the test connection to an attacker-controlled IMAP host, causing the real stored IMAP password or OAuth token to be sent to that host.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71244?
CVE-2026-71244 has a severity score of 7.1, indicating a high risk.
How does CVE-2026-71244 affect user credentials?
CVE-2026-71244 allows attacker-controlled hosts to leak stored IMAP/OAuth credentials through the MailAccountViewSet.test() action.
What component of Paperless-ngx is vulnerable in CVE-2026-71244?
The vulnerability in CVE-2026-71244 specifically affects the MailAccountViewSet.test() action within Paperless-ngx.
Can CVE-2026-71244 be exploited remotely?
Yes, CVE-2026-71244 can be exploited remotely, as it involves a network-accessible endpoint.
How do I mitigate the risks associated with CVE-2026-71244?
To mitigate the risks of CVE-2026-71244, avoid using exposed credentials and apply recommended updates from the Paperless-ngx maintainers.