Summary
Papermerge Core contains missing authorization checks in page management and OCR-related endpoints, allowing authenticated users to act on pages belonging to other users. If an attacker knows or obtains valid page UUIDs, they may rotate, move, delete, extract, or submit those pages for OCR processing.
Papermerge Core contains missing authorization checks in page management and OCR-related endpoints, allowing authenticated users to act on pages belonging to other users. If an attacker knows or obtains valid page UUIDs, they may rotate, move, delete, extract, or submit those pages for OCR processing.
Affected context
The vulnerability occurs in Papermerge Core deployments where authenticated users can reach page-management or OCR endpoints that do not consistently enforce node-level permissions. The affected operations include page handling, page movement, page extraction, and OCR task submission, with exploitation depending on access to valid page identifiers.
The vulnerability occurs in Papermerge Core deployments where authenticated users can reach page-management or OCR endpoints that do not consistently enforce node-level permissions. The affected operations include page handling, page movement, page extraction, and OCR task submission, with exploitation depending on access to valid page identifiers.
Exploit preconditions
- Attack surface: Authenticated HTTP endpoints for page management and OCR
- Required access: A valid Papermerge user account and knowledge of, or access to, target page UUIDs
- Trigger point: Requests to page, move, extract, or OCR-related endpoints
- Why exploitation is possible: The endpoints may process requests without enforcing the expected
has_node_permauthorization checks
- Attack surface: Authenticated HTTP endpoints for page management and OCR
- Required access: A valid Papermerge user account and knowledge of, or access to, target page UUIDs
- Trigger point: Requests to page, move, extract, or OCR-related endpoints
- Why exploitation is possible: The endpoints may process requests without enforcing the expected
has_node_permauthorization checks
Why this happens
The underlying bug is an authorization enforcement gap. Sensitive page-management and OCR operations trust endpoint reachability or authentication status without consistently verifying whether the requesting user has permission for the specific document node or page.
This maps to CWE-862: Missing Authorization, in which an application fails to enforce access control for a protected action or resource. The insecure pattern is allowing authenticated users to invoke object-level operations without validating ownership, role, or node-specific permissions at the point of use.
The underlying bug is an authorization enforcement gap. Sensitive page-management and OCR operations trust endpoint reachability or authentication status without consistently verifying whether the requesting user has permission for the specific document node or page.
This maps to CWE-862: Missing Authorization, in which an application fails to enforce access control for a protected action or resource. The insecure pattern is allowing authenticated users to invoke object-level operations without validating ownership, role, or node-specific permissions at the point of use.
Potential impact
- Unauthorized users may rotate or otherwise modify another user's pages
- Victims' pages may be moved or deleted
- Page content may be extracted without appropriate authorization
- OCR processing may be triggered for pages outside the user's permitted scope
- Confidentiality, integrity, and availability of stored documents could be affected
- Unauthorized users may rotate or otherwise modify another user's pages
- Victims' pages may be moved or deleted
- Page content may be extracted without appropriate authorization
- OCR processing may be triggered for pages outside the user's permitted scope
- Confidentiality, integrity, and availability of stored documents could be affected
General mitigation guidance
Mitigation generally focuses on enforcing object-level authorization consistently across every page and OCR operation.
Common defensive patterns include:
- Applying node-specific permission checks within each endpoint and service-layer operation
- Using centralized authorization middleware or policy functions to reduce endpoint-specific omissions
- Treating page UUIDs as identifiers rather than proof of access
- Returning uniform authorization failures without revealing whether another user's object exists
- Restricting OCR task creation and document extraction to resources the caller is permitted to access
- Running background tasks with only the permissions required for their intended operation
- Adding authorization tests for read, modify, move, delete, extract, and task-submission workflows
Mitigation generally focuses on enforcing object-level authorization consistently across every page and OCR operation.
Common defensive patterns include:
- Applying node-specific permission checks within each endpoint and service-layer operation
- Using centralized authorization middleware or policy functions to reduce endpoint-specific omissions
- Treating page UUIDs as identifiers rather than proof of access
- Returning uniform authorization failures without revealing whether another user's object exists
- Restricting OCR task creation and document extraction to resources the caller is permitted to access
- Running background tasks with only the permissions required for their intended operation
- Adding authorization tests for read, modify, move, delete, extract, and task-submission workflows
How teams detect issues like this
Organizations can look for missing authorization through:
- Static analysis and code review rules that identify handlers accessing page objects without nearby permission checks
- Review of service-layer methods to confirm authorization is revalidated rather than inherited from route authentication
- Tests that replay object-level operations using authenticated accounts with different ownership or node permissions
- API policy enforcement requiring authorization decisions for every resource-changing or data-extracting action
- Monitoring for repeated requests involving page UUIDs outside a user's normal document scope
- Automated security testing that checks horizontal privilege boundaries across page and OCR endpoints
Organizations can look for missing authorization through:
- Static analysis and code review rules that identify handlers accessing page objects without nearby permission checks
- Review of service-layer methods to confirm authorization is revalidated rather than inherited from route authentication
- Tests that replay object-level operations using authenticated accounts with different ownership or node permissions
- API policy enforcement requiring authorization decisions for every resource-changing or data-extracting action
- Monitoring for repeated requests involving page UUIDs outside a user's normal document scope
- Automated security testing that checks horizontal privilege boundaries across page and OCR endpoints
