Description
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by supplying a group_id parameter. Attackers who know a group's UUID can query GET /tags/all or GET /document-types/all, which skip the user_belongs_to check, to disclose metadata of groups they do not belong to.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
papermerge papermerge-core
Default version status: unaffected
0 to ≤ 3.5.3affected
pkg:github/papermerge/papermerge-coreReferences
- https://github.com/papermerge/papermerge-core/issues/1291 ↗
- https://github.com/papermerge/papermerge-core/blob/3.5.3/papermerge/core/features/tags/router.py#L39-L64 ↗
- https://github.com/papermerge/papermerge-core/blob/3.5.3/papermerge/core/features/document_types/router.py#L37-L62 ↗
- https://github.com/papermerge/papermerge-core/commit/0fd469102b05b5ebeb5ee39b3f73ff76991ab269 ↗
- https://www.vulncheck.com/advisories/papermerge-core-through-3.5.3-missing-authorization-via-tags-all-and-document-types-all ↗