CVE-2026-110623

7.5High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-862

Impact

Authenticated users can read, modify, or delete any user's documents and revoke existing shares. To exploit this, an attacker only needs a low-privileged account to supply arbitrary document UUIDs to the shared nodes API.

Root cause

The shared nodes API endpoints lack authorization checks to verify whether the requester owns or has rights to share the target node UUID.

Affected systems

Papermerge Core through 3.5.3

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade to a fixed version beyond 3.5.3 or apply commit 0fd469102b05b5ebeb5ee39b3f73ff76991ab269; if patching must wait, block or restrict access to POST /shared-nodes and PATCH /shared-nodes/access/ at your reverse proxy.

shell

$ pip install --upgrade papermerge-core

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/{node_id} to grant themselves any role, then read, modify, or delete victims' documents and revoke existing shares.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-110623