Description
Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/{node_id} to grant themselves any role, then read, modify, or delete victims' documents and revoke existing shares.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
papermerge papermerge-core
Default version status: unaffected
0 to ≤ 3.5.3affected
pkg:github/papermerge/papermerge-coreReferences
- https://github.com/papermerge/papermerge-core/issues/1290 ↗
- https://github.com/papermerge/papermerge-core/issues/1291 ↗
- https://github.com/papermerge/papermerge-core/blob/3.5.3/papermerge/core/features/shared_nodes/router.py#L78-L150 ↗
- https://github.com/papermerge/papermerge-core/commit/0fd469102b05b5ebeb5ee39b3f73ff76991ab269 ↗
- https://www.vulncheck.com/advisories/papermerge-core-through-3.5.3-missing-authorization-in-shared-nodes-api ↗