CVE-2026-111350 — Papermark through 0.22.0 Missing Authorization in Data Room Viewer Group API
Papermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer group API that allows authenticated users to delete other teams' viewer groups an…
Published: 2026-10-15 · CVSS: 2.3 · CVSS 4.0
Papermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer group API that allows authenticated users to delete other teams' viewer groups and share links. Attackers who know a victim team's data room and group identifiers can send DELETE requests, read group links, or rewrite group document permissions across teams.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7