The vulnerability in Paperless-ngx's MailAccountViewSet.test() action (CVE-2026-71244) arises when the action is called with an existing account's ID and a masked password field. The system reuses stored sensitive credentials such as the password, account_type, refresh_token, and expiration from the existing account, but allows the caller to specify different IMAP server parameters (imap_server, imap_port, imap_security). Consequently, the test connection authenticates to the caller-specified IMAP server using the real stored credentials. A user with only object-level change_mailaccount permission (not full admin) can exploit this to redirect the authentication to an attacker-controlled IMAP host, exposing the real stored IMAP password or OAuth token to the attacker.

An attacker with limited permissions can cause the system to send real stored IMAP credentials or OAuth tokens to an attacker-controlled server. This leads to credential exposure and potential unauthorized access to the victim's email account. The vulnerability does not affect system integrity or availability directly but results in a high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict the change_mailaccount permission to fully trusted users only and monitor for suspicious use of the MailAccountViewSet.test() action. Avoid allowing untrusted users to specify IMAP server parameters during test connection requests.