https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 22:07:09 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-110623 <p>Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users&#39; documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/{node_id} to grant themselves any role, then read, modify, or delete victims&#39; documents and revoke existing shares.</p> <p>Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users&#39; documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/{node_id} to grant themselves any role, then read, modify, or delete victims&#39; documents and revoke existing shares.</p> https://db.gcve.eu/vuln/fkie_cve-2026-110623 https://db.gcve.eu/vuln/ghsa-w6cv-8rwh-jrfj <p>Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users&#39; documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/{node_id} to grant themselves any role, then read, modify, or delete victims&#39; documents and revoke existing shares.</p> <p>Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users&#39; documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/{node_id} to grant themselves any role, then read, modify, or delete victims&#39; documents and revoke existing shares.</p> https://db.gcve.eu/vuln/ghsa-w6cv-8rwh-jrfj