CVE-2026-110622
7.5HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-862
Impact
Authenticated attackers can view, rotate, delete, or extract other users' document pages and trigger unauthorized OCR tasks if they know or guess page UUIDs. They only need standard authenticated user access to the Papermerge Core instance.
Root cause
The page management and OCR endpoints omit 'has_node_perm' permission checks when processing requests.
Affected systems
Papermerge Core through 3.5.3
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade Papermerge Core to a commit or version containing fix 6ad2836dc40b61bd032146013272036bbece6144 (versions newer than 3.5.3). If patching is blocked, block access to the '/pages/', '/pages/move', '/pages/extract', and '/tasks/ocr' endpoints at your reverse proxy.
$ pip install --upgrade papermerge-coreAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip has_node_perm checks. Attackers knowing page UUIDs can call /pages/, /pages/move, or /pages/extract to rotate, delete, or extract victims' pages, and trigger OCR via /tasks/ocr.
References
- https://github.com/papermerge/papermerge-core/blob/3.5.3/papermerge/core/features/document/router_pages.py#L29-L131
- https://github.com/papermerge/papermerge-core/blob/3.5.3/papermerge/core/features/tasks/router.py#L17-L35
- https://github.com/papermerge/papermerge-core/commit/6ad2836dc40b61bd032146013272036bbece6144
- https://github.com/papermerge/papermerge-core/issues/1290
- https://www.vulncheck.com/advisories/papermerge-core-through-3.5.3-missing-authorization-in-page-management-and-ocr-endpoints