Papermark through version 0.22.0 has a missing authorization check in the data room viewer group API. The flaw allows an authenticated user to delete other teams’ viewer groups and share links, read group links, or rewrite group document permissions across teams. Attackers who know a victim team's data room and group identifiers can send DELETE requests to the API to remove viewer groups, remove or alter share links, and change permissions that control document accessibility. The result is untrusted users gaining full control over other teams’ viewer groups and shared content, potentially causing loss of data visibility, disruption of collaboration, and unauthorized modification of access rights.

Papermark versions up to and including 0.22.0 are impacted. The vulnerability exists in the data room viewer group API exposed by Papermark, as used by authenticated users of the application.

The CVSS score is 2.3, indicating low overall severity, and the EPSS score is < 1%, indicating a low likelihood of exploitation. The vulnerability is not listed in CISA KEV. The attack vector is likely remote, through HTTP API requests. An attacker must first be authenticated to a Papermark account and possess knowledge of the target team’s data room and group identifiers. With those prerequisites, they can issue crafted DELETE requests to remove viewer groups, access share links, or alter permissions, thereby bypassing team boundaries and ownership controls. No known usage of this flaw in the wild is reported at this time, but the missing authorization logic presents a clear privilege escalation risk for authenticated users.