CVE-2026-110623
Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.50%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/{node_id} to grant themselves any role, then read, modify, or delete victims' documents and revoke existing shares.
- CVSS 4.0
- 7.7 HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.50% probability · 42th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-862
- Source
- disclosure@vulncheck.com
EPSS moved from 0.5% on 15 October 2026 to 0.5% on 26 October 2026.
References
- https://github.com/papermerge/papermerge-core/blob/3.5.3/papermerge/core/features/shared_nodes/router.py#L78-L150
- https://github.com/papermerge/papermerge-core/commit/0fd469102b05b5ebeb5ee39b3f73ff76991ab269
- https://github.com/papermerge/papermerge-core/issues/1290
- https://github.com/papermerge/papermerge-core/issues/1291
- https://www.vulncheck.com/advisories/papermerge-core-through-3.5.3-missing-authorization-in-shared-nodes-api
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.