CVE-2026-110622 — Papermerge Core through 3.5.3 Missing Authorization in Page Management and OCR Endpoints
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR end…
Published: 2026-10-14 · CVSS: 7.7 · CVSS 4.0
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip has_node_perm checks. Attackers knowing page UUIDs can call /pages/, /pages/move, or /pages/extract to rotate, delete, or extract victims' pages, and trigger OCR via /tasks/ocr.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7