Warracker before 1.0.4 contains a missing authorization flaw in its Paperless‑ngx integration that allows an authenticated non‑administrative user to bypass document ownership restrictions. The vulnerability resides in the paperless_search_and_link() and serve_paperless_document() route handlers, which let a user search for another user's private document ID and link it to a warranty they own using the `other` document type. As a result the user can read documents that belong to others, causing a confidentiality loss.

The affected product is Warracker from the vendor sassanix. All releases prior to version 1.0.4 are impacted; users running 1.0.3 or earlier should upgrade promptly.

The CVSS score of 6 reflects moderate severity. The EPSS score is not available, so the likelihood of exploitation cannot be assessed quantitatively, and the vulnerability is not listed in CISA’s KEV catalog. An attacker only needs an authenticated non‑administrator account and the shared Paperless‑ngx API credentials used by the application; by calling the exposed routes the attacker can locate and retrieve private documents belonging to other users.