CVE-2026-110623: Missing Authorization in papermerge papermerge-core

CVE-2026-110623 describes a missing authorization vulnerability in Papermerge Core through version 3.5.3. The flaw exists in the shared nodes API endpoints POST /shared-nodes and PATCH /shared-nodes/access/{node_id}, where authenticated users can supply arbitrary node UUIDs to share documents belonging to other users. By exploiting this, attackers can escalate privileges on these documents by assigning themselves any role, thereby gaining the ability to read, modify, delete, or revoke shares on documents they do not own.

An attacker with authenticated access can bypass authorization controls to access and manipulate documents owned by other users. This includes reading sensitive information, modifying document contents, deleting documents, or revoking legitimate shares. The vulnerability compromises confidentiality, integrity, and availability of user documents within Papermerge Core.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users only and monitor for suspicious activity related to shared nodes API usage.