Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-110622: Papermerge Core lets logged-in users alter others’ documents

CVE-2026-110622 · published 1 day ago

Summary

In Papermerge Core versions up to 3.5.3, the system does not properly verify who is allowed to manage pages or run OCR. As a result, any user who is signed in can change, delete, or extract another user's pages if they know the page identifier. Upgrade to the latest release or apply the provided fix to restore proper access controls.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
papermerge	papermerge-core	<= 3.5.3

Original advisory text

Papermerge Core through 3.5.3 Missing Authorization in Page Management and OCR Endpoints

Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip has_node_perm checks. Attackers knowing page UUIDs can call /pages/, /pages/move, or /pages/extract to rotate, delete, or extract victims' pages, and trigger OCR via /tasks/ocr.

References

https://github.com/papermerge/papermerge-core/issues/1290 Third Party Advisory
https://github.com/papermerge/papermerge-core/blob/3.5.3/papermerge/core/feature... Third Party Advisory
https://github.com/papermerge/papermerge-core/blob/3.5.3/papermerge/core/feature... Third Party Advisory
https://github.com/papermerge/papermerge-core/commit/6ad2836dc40b61bd03214601327... Patch
https://www.vulncheck.com/advisories/papermerge-core-through-3.5.3-missing-autho... Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-1106... Vendor Advisory
https://github.com/papermerge/papermerge-core Product
https://nvd.nist.gov/vuln/detail/CVE-2026-110622 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.4 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-862Missing Authorization

Timeline

Published14 Oct 2026

Updated15 Oct 2026

First seen14 Oct 2026

Sources

CVE-2026-110622 · NVD

CVE-2026-110622 · MITRE

CVE-2026-110622 · OSV

Track software like this

Free during beta