Papermerge Core through version 3.5.3 lacks proper authorization checks in the shared nodes API. An authenticated user can craft requests to POST /shared-nodes or PATCH /shared-nodes/access/{node_id} with arbitrary node UUIDs. This permits the attacker to grant themselves any share role, enabling read, modify, or delete access to other users’ documents and the ability to revoke existing shares that they do not own. The vulnerability therefore allows unauthorized data disclosure, integrity violations, and privilege escalation within the document repository.

The issue affects Papermerge Core from its initial releases up through 3.5.3. The affected product is the open‑source document management application released by the Papermerge team. No specific service configurations are listed as mitigable beyond upgrading the core application.

The CVSS score of 7.7 indicates a high severity. Exploitation requires an attacker to have valid authenticated credentials; the missing authorization check allows any such user to grant themselves arbitrary share roles on other users' documents, enabling them to read, modify, or delete those documents. The EPSS score of 0.00499 (<1%) indicates a very low probability of widespread exploitation, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the risk remains significant for any organization that relies on strict access controls within an authenticated environment.