Skip to content
OpenAdvisories

Vendor

paperless-ngx

2 known vulnerabilities.

Products

paperless-ngx 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-71244

    Paperless-ngx - Mail Account Test Connection Leaks Stored IMAP/OAuth Credentials to Attacker-Controlled Host

    Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, account_type, refresh_token, and expiration from that existing account while allowing the caller to supply a dif…

    paperless-ngx paperless-ngx
  • Medium 5.5
    CVE-2024-35184

    paperless-ngx's remote user auth via header works even when disabling it for API

    Paperless-ngx is a document management system that transforms physical documents into a searchable online archive. Starting in version 2.5.0 and prior to version 2.8.6, remote user authentication allows API access even if API access is explicitly disabled. Ve…

    paperless-ngx paperless-ngx