The Paperclip platform suffered a critical security defect tracked as CVE-2026-41679 with a CVSS score of 10. The vulnerability allowed remote attackers to bypass authorization by self-registering accounts without email verification, signing in, and completing a CLI authorization challenge to obtain board-level API tokens. This access permitted importing new companies using crafted YAML bundles that could specify agents executing arbitrary commands on the server with the service account's privileges. The flaw existed because the import path required only board-level access, not instance-admin privileges. Additional bugs included missing authorization on API routes causing sensitive data exposure and a DNS rebinding vulnerability in local development mode that enabled code execution on developer machines. The vendor fixed these issues by enforcing authorization checks on import preview and execution flows and restricting company scoping.

Successful exploitation grants attackers board-level API access and the ability to execute arbitrary code with the Paperclip server's permissions. This can lead to unauthorized access to application data, source repositories, local credentials, secrets, and internal services reachable from the host. The DNS rebinding vulnerability in local development mode could allow attackers to execute code on developer machines if they visit a malicious website. These combined flaws pose a critical risk to confidentiality, integrity, and availability of affected Paperclip instances.

Paperclip has released fixes that apply authorization checks to the import preview and execution flows and tighten company scoping to require appropriate privileges. The vendor also resolved missing authorization on API routes and the DNS rebinding issue in local development mode. Users should update to the fixed versions as soon as possible. Patch status is confirmed by the vendor's advisory. No additional mitigation is required beyond applying the official fixes.