Papermerge Papermerge-Core vulnerabilities

3 CVEs affecting Papermerge Papermerge-Core, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-110624, published 2026-10-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-110623, published 2026-10-14. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs.…
CVE-2026-110622, published 2026-10-14. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip…
CVE-2026-110624, published 2026-10-14. Low severity, CVSS 3.1. EPSS: 0.3% chance of exploitation in the next 30 days. Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by supplying a group_id parameter. Attackers…