CVE-2026-71244

Name of the Vulnerable Software and Affected Versions Paperless-ngx (affected versions not specified)

Description An issue exists in the MailAccountViewSet.test() action. When this action is called using an existing account ID and a masked password field, the system reuses the stored password, account type, refresh token, and expiration from that account. However, it allows the caller to specify a different imap server, imap port, and imap security within the same request. Consequently, the test connection authenticates to the caller-specified server using the actual stored credentials. A user with object-level change mailaccount permission on the target account can redirect the test connection to an attacker-controlled IMAP host, leading to the leakage of the stored IMAP password or OAuth token.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.