GHSA-3h89-rqfj-5674: Warracker before 1.0.4 Missing Authorization via Paperless-ngx Document Linking

Warracker before 1.0.4 contains a missing authorization vulnerability in its Paperless-ngx integration that allows an authenticated, non-administrative user to bypass document ownership restrictions by searching for and linking another user's private document ID to a warranty they own using the other document type. Attackers can exploit insufficient authorization checks in the paperlesssearchandlink() and servepaperlessdocument() route handlers in fileroutes.py to retrieve and disclose private documents belonging to another user via the shared Paperless-ngx API credential, resulting in unauthorized read access and confidentiality loss.