Papermerge Core up to version 3.5.3 contains a missing authorization flaw that allows authenticated users to manipulate pages belonging to other accounts. The page management and OCR endpoints do not enforce the required permission checks on the node, enabling an attacker to rotate, delete, extract, or trigger OCR for any page whose UUID is known. This results in integrity and confidentiality loss for document content, potential data loss if pages are deleted, and denial of service if excessive OCR jobs are initiated. The weakness is classified as an authorization bypass, corresponding to CWE‑862.

Any deployment of Papermerge Core up to and including 3.5.3 is affected. The flaw applies to all users with authenticated access, regardless of their role or privileges, as the permission check is entirely omitted for the exposed endpoints.

The CVSS score of 7.7 points to high severity. Exploitation requires the attacker to be already authenticated and to possess the UUID of the target page; this information can be gleaned from normal application usage or through side‑channel reconnaissance. The EPSS score of 0.00499 (<1%) indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is purely internal, limited to the application’s own user authentication, but can have widespread impact on all documents managed by the affected system.