PT-2026-114066 · Papermerge · Papermerge-Core
CVSS v3.1
3.1
Low
| Vector | AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by supplying a group id parameter. Attackers who know a group's UUID can query GET /tags/all or GET /document-types/all, which skip the user belongs to check, to disclose metadata of groups they do not belong to.
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Papermerge-Core