Threat database

Papermerge Core versions up to 3.5.3 have a missing authorization vulnerability that allows authenticated users to access metadata of groups they do not belong to by supplying a group_id parameter. This affects the GET /tags/all and GET /document-types/all endpoints, which do not properly verify group membership before disclosing tags and document types.

Papermerge Core versions up to and including 3.5.3 have a missing authorization vulnerability in the shared nodes API. Authenticated users can exploit this flaw by supplying arbitrary node UUIDs to share other users' documents. This allows attackers to grant themselves any role on these documents, enabling them to read, modify, delete, or revoke shares of victims' documents.

Papermerge Core versions up to 3.5.3 have a missing authorization vulnerability that allows authenticated users to manipulate other users' pages. The vulnerability arises because certain page management and OCR endpoints do not enforce permission checks. Attackers with knowledge of page UUIDs can rotate, delete, extract pages, or trigger OCR tasks on pages they do not own.

A security flaw has been discovered in Papermerge DMS up to 3.5.3. This issue affects some unknown processing of the component Authorization Token Handler. Performing manipulation results in improper authorization. The attack can be initiated remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.