CVE-2026-71244: Paperless-Ngx

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, account_type, refresh_token, and expiration from that existing account while allowing the caller to supply a different imap_server, imap_port, and imap_security in the same request.

Affected products

• Paperless-Ngx Paperless-Ngx: version 0 only

Published 2026-08-05. Last modified 2026-08-26.