Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API… (CVE-2026-82472)
Description
Documenso versions before 2.13.0 have a vulnerability in the /api/files/upload-pdf endpoint that allows unauthenticated attackers to upload PDF files without any authentication or API credentials. This can lead to exhaustion of storage resources or filling the database with unlinked document records.
CVSS v3.1
Score 7.5high
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Documenso before version 2.13.0 permits unauthenticated PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. This lack of access control allows attackers to upload arbitrary PDF files indefinitely, potentially exhausting storage capacity or cluttering the database with unlinked documents. The vulnerability is identified as CWE-306 (Missing Authentication for Critical Function).
Potential Impact
The vulnerability does not impact confidentiality or integrity directly but has a high impact on availability by enabling denial of service through resource exhaustion. Attackers can upload unlimited PDF files, which may fill storage or database capacity, disrupting normal service operation.
Mitigation Recommendations
No official patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restricting access to the /api/files/upload-pdf endpoint or implementing authentication controls is recommended to prevent unauthenticated uploads.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-qm54-2jq3-88j9
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-82472"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a944bd8acd9273b49b25b9e
Added to database: 08/30/2026, 15:27:20 UTC
Last enriched: 09/08/2026, 01:22:09 UTC
Last updated: 10/15/2026, 18:48:24 UTC
Views: 116
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.