PatchSiren cyber security CVE debrief
CVE-2026-48052 papra-hq CVE debrief
CVE-2026-48052 is a vulnerability in Papra, a minimalistic document management and archiving platform. An authenticated user who is a member of any organization can delete or rename tags belonging to a different organization, given the target tag's ID. The issue arises because the route handler verifies the caller's membership of the organization ID in the URL, but the repository write filters on tag ID alone, bypassing URL-level organization scope checks. This vulnerability has a CVSS score of 5.4 and is classified as MEDIUM severity.
- Vendor
- papra-hq
- Product
- papra
- CVSS
- MEDIUM 5.4
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-27
- Original CVE updated
- 2026-07-27
- Advisory published
- 2026-07-27
- Advisory updated
- 2026-07-27
Who should care
Users of Papra document management platform, especially those with multiple organizations and shared users, should be aware of this vulnerability. System administrators and security teams responsible for Papra installations should prioritize patching to version 26.5.0 or later and review access controls for tags.
Technical summary
The vulnerability exists in the route handler for tag operations within Papra, a minimalistic document management and archiving platform. Although it checks if the caller is a member of the organization specified in the URL, it does not properly enforce organization scope when filtering repository writes. This allows an authenticated user to manipulate tags from other organizations if they know the target tag's ID. The issue has been patched in version 26.5.0, which corrects the oversight in repository write filters.
Defensive priority
Medium priority due to the requirement for authentication and the specificity of the attack vector, but high for organizations with shared user access across multiple organizations.
Recommended defensive actions
- Upgrade to Papra version 26.5.0 or later
- Review and restrict tag access controls
- Monitor for suspicious tag operations
- Implement additional logging and auditing for tag changes
- Review compensating controls for exposed systems while remediation is scheduled and verified
- Check relevant monitoring, detection, and logs for exposed assets that need extra review
- Track exceptions, retest remediated assets, and close the item only after evidence is documented
Evidence notes
The CVE record was published on 2026-07-27T18:16:55.780Z and last modified on 2026-07-27T19:17:16.170Z. The vulnerability details are based on information from the CVE record and related references. Evidence limits suggest verifying Papra version 26.5.0 or later for patched systems and reviewing system logs for suspicious tag operations. Defensive verification tasks include confirming system configurations and monitoring for unexpected changes.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-27T18:16:55.780Z and has not been modified since then.