Skip to content
Authorization Flaws in Papermerge API Expose User Data

Authorization Flaws in Papermerge API Expose User Data

First seen 15 Oct 2026, 06:33 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 15, 2026 at 08:37 UTC
  • •Critical authorization flaws allow unauthorized access to user data.
  • •Multiple API endpoints are affected, including shared nodes and document management.
  • •No patches have been released as of the disclosure date.

Two significant security issues were identified in the Papermerge API, affecting user data privacy. Article 1 highlights missing authorization checks in the PATCH /shared-nodes/access/{node_id} endpoint, allowing users with only VIEW permissions to modify access controls. Article 2 reports similar vulnerabilities across multiple endpoints, including POST /pages/ and POST /shared-nodes, where any authenticated user can manipulate resources without ownership verification. These flaws could lead to unauthorized access and manipulation of shared nodes and documents. The issues were disclosed on October 15, 2026, with no patches reported yet. The severity of these vulnerabilities is underscored by their potential to impact all authenticated users of the Papermerge system.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-15
Vulnerabilities disclosed
Critical authorization flaws were reported in Papermerge API endpoints, affecting user data access and manipulation.
github.com
2026-10-15
Additional vulnerabilities reported
Further issues were identified in the Papermerge API, including missing ownership checks across multiple endpoints.
github.com

More articles in this cluster (2)

Extracted Entities (3)

1 / 3

Common questions

What specific endpoints are affected?
The vulnerabilities affect endpoints like PATCH /shared-nodes/access/{node_id} and POST /pages/.
Is there a patch available?
No patches have been reported as of the disclosure date, October 15, 2026.
What should users do to protect their data?
Users should monitor their access controls and limit sharing until a patch is released.