CVE-2026-110623 papermerge CVE debrief

Who should care

Defenders responsible for Papermerge Core installations, especially those with shared node functionality enabled, should assess exposure and verify the effectiveness of existing authorization controls.

Why it matters

CVE-2026-110623 is a high-severity vulnerability in Papermerge Core's shared nodes API, allowing authenticated users to share other users' documents without proper authorization. Defenders should prioritize verifying exposure and assessing the effectiveness of existing authorization controls.

• Potential unauthorized access to sensitive documents.
• Possible data tampering or deletion.
• Revocation of existing shares.
• Verification of authorization controls is required.

Technical summary

The vulnerability exists in the shared nodes API of Papermerge Core through version 3.5.3. Authenticated users can exploit this by supplying arbitrary node UUIDs to share other users' documents, potentially allowing unauthorized access to sensitive information. The vulnerability has a high CVSS score of 7.7 and is considered a significant risk. Defenders should prioritize verifying exposure of Papermerge Core installations, especially those with shared node functionality enabled, and assess the effectiveness of existing authorization controls. The CVE record and source item provide details on the missing authorization vulnerability in Papermerge Core's shared nodes API.

Defensive priority

Defenders should prioritize verifying exposure of Papermerge Core installations, especially those with shared node functionality enabled, and assess the effectiveness of existing authorization controls.

Recommended defensive actions

• Verify exposure of Papermerge Core installations, especially those with shared node functionality enabled.
• Assess the effectiveness of existing authorization controls.
• Review and update authorization settings for shared nodes.
• Monitor for suspicious activity related to shared nodes.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Evidence notes

The CVE record and source item provide details on the missing authorization vulnerability in Papermerge Core's shared nodes API. However, the corpus does not establish versions beyond 3.5.3, exploitation, impact, or remediation, which require verification from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.