CVE-2024-35184 — paperless-ngx's remote user auth via header works even when disabling it for API
Paperless-ngx is a document management system that transforms physical documents into a searchable online archive. Starting in version 2.5.0 and prior to version 2.8.6, remote u…
Published: 2024-05-15 · CVSS: 5.5 · CVSS 3.1
Paperless-ngx is a document management system that transforms physical documents into a searchable online archive. Starting in version 2.5.0 and prior to version 2.8.6, remote user authentication allows API access even if API access is explicitly disabled. Version 2.8.6 contains a patchc for the issue.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7