The vulnerability is caused by a missing authorization check that allows authenticated users to query the /tags/all and /document-types/all endpoints with a group_id parameter. By supplying any group’s UUID, an attacker can obtain a list of tags and document types belonging to that group, exposing metadata that should be protected. This is a classic missing authorization flaw (CWE‑862) and the primary impact is the unauthorized disclosure of group‑specific information.

Papermerge Core installations running versions up to and including 3.5.3 are affected. Any deployment of the vendor’s papermerge-core product that has not applied the corrective change introduced after the commit 0fd4691 is vulnerable. No specific hardware or region constraints are mentioned, so all installations of the impacted product version are at risk.

The CVSS score of 2.3 indicates a low severity overall, and the EPSS probability of exploitation is less than 1%, indicating a low likelihood of active exploitation. The vulnerability is not listed in the CISA KEV catalog, further indicating it has not been widely exploited. Attackers must be authenticated and must know a target group’s UUID to exploit the flaw; if they cannot discover such UUIDs, the attack surface is limited. Overall, the risk is moderate due to the small amount of data exposed, but the lack of high‑impact consequences keeps overall exposure low.