Multiple API endpoints lack the has_node_perm() authorization check that is consistently applied across all other resource-accessing endpoints. This allows any authenticated user to manipulate pages in other users' documents, other users' nodes, and trigger OCR on other users' documents.
Finding 1: Pages Router - Missing has_node_perm() on All 3 Endpoints (HIGH)
File: papermerge/core/features/document/router_pages.py
All three page management endpoints lack has_node_perm() :
POST /pages/ ( apply_page_operations ) - manipulate pages by ID without ownership check
POST /pages/move ( move_pages ) - move pages between documents without ownership check
POST /pages/extract ( extract_pages ) - extract pages without ownership check
The DB layer queries orm.Page.id.in_(page_ids) without any ownership verification. The user_id parameter is only used for audit trail fields, not authorization.
Secure comparison - Every endpoint in the document router, document version router, nodes router, folders router, and thumbnails router calls:
Finding 2: Shared Nodes Router - Missing Ownership Checks (HIGH)
File: papermerge/core/features/shared_nodes/router.py
2a. POST /shared-nodes - no ownership check on node_ids
Any user can ANY node with arbitrary users/groups. The node_ids from user input are passed directly to create_shared_nodes() without verifying ownership.
2b. GET /shared-nodes/access/{node_id} - no ownership check
Any user can see who has access to any node.
2c. PATCH /shared-nodes/access/{node_id} - wrong scope enforced
The endpoint enforces SHARED_NODE_VIEW scope instead of SHARED_NODE_UPDATE :
Finding 3: OCR Task - Missing has_node_perm() (MEDIUM)
File: papermerge/core/features/tasks/router.py
POST /tasks/ocr accepts a document_id and sends it to the OCR worker without any has_node_perm() check. Any user can trigger OCR on any document.
Add has_node_perm() checks to all three pages router endpoints
Add ownership verification to shared nodes create/access/update endpoints
Fix the PATCH scope from SHARED_NODE_VIEW to SHARED_NODE_UPDATE
Add has_node_perm() to the OCR task endpoint
CWE-862: Missing Authorization
ciur self-assigned this on Feb 28, 2026
ciur added security on Feb 28, 2026
marfoerst added blocker confirmed on Sep 19, 2026
Jalst added a commit that references this issue on Sep 24, 2026 fix: authorization checks in pages and OCR endpoints ( #1290 ) 6ad2836
fix: authorization checks in pages and OCR endpoints ( #1290 )
Jalst closed this as completed in #1325 on Sep 24, 2026
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
