Threats tagged 'ghsa-xqgh-rxmq-pv66'

Warracker versions before 1.0.4 have a missing authorization vulnerability in their Paperless-ngx integration. This flaw allows authenticated users without administrative privileges to bypass document ownership restrictions. By exploiting insufficient authorization checks in specific route handlers, an attacker can access private documents of other users through the shared Paperless-ngx API credential, leading to unauthorized disclosure of confidential information.