CVE-2026-110622 papermerge CVE debrief

Who should care

Defenders responsible for Papermerge Core installations, especially those with authenticated user access, should assess exposure and potential impact. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review and update access controls for page management and OCR endpoints. They should also monitor for suspicious activity related to page manipulation and OCR tasks.

Why it matters

The missing authorization vulnerability in Papermerge Core through 3.5.3 allows authenticated users to manipulate other users' pages, potentially disrupting document management processes and exposing sensitive information.

• Potential unauthorized page manipulation by authenticated users
• Possible disruption of document management processes
• Risk of sensitive information exposure through OCR tasks
• Need for verification of access controls and user permissions

Technical summary

The vulnerability allows authenticated users to manipulate other users' pages by skipping has_node_perm checks in page management and OCR endpoints. This could lead to unauthorized page manipulation, disruption of document management processes, and exposure of sensitive information. The affected product is Papermerge Core through 3.5.3, and defenders should assess exposure and potential impact, especially in environments with authenticated user access. The vulnerability is a missing authorization issue in page management and OCR endpoints.

Defensive priority

Defenders should prioritize verifying exposure of Papermerge Core installations, especially those with authenticated user access, and assess potential impact on document management and OCR processes.

Recommended defensive actions

• Verify exposure of Papermerge Core installations, especially those with authenticated user access
• Assess potential impact on document management and OCR processes
• Review and update access controls for page management and OCR endpoints
• Monitor for suspicious activity related to page manipulation and OCR tasks
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE record and source item provide details on the missing authorization vulnerability in Papermerge Core through 3.5.3, including affected versions and potential attack vectors. The vulnerability allows authenticated users to manipulate other users' pages by skipping has_node_perm checks in page management and OCR endpoints. Evidence is limited to the CVE record and source item, and defenders should verify exposure and potential impact. The missing authorization vulnerability could lead to unauthorized page manipulation, and it is

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.