Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, an authenticated user who is a member of any organization can delete or rename tags belonging to a different organization, given the target tag's ID. The route handler verifies the caller's membership of the organization specified in the URL, but the repository write filters only on the tag ID, so the organization context never reaches the database, allowing users to modify or delete tags outside their own organization and causing loss of data integrity and potential compliance violations; this weakness is an instance of insufficient authorization (CWE‑639).

The issue affects installations of Papra from the open-source project papra-hq/papra prior to version 26.5.0. All community releases in that range are vulnerable.

The CVSS score of 5.4 indicates moderate severity, and the EPSS score of <1% suggests a low exploitation probability, so the likelihood of widespread exploitation is unclear. The vulnerability is not listed in CISA's KEV catalog. An attacker only needs legitimate credentials and knowledge of the target tag ID, which is typically obtainable through use of the system or by enumerating tags within the organization. Once authenticated, the attacker can perform destructive operations on tags belonging to other orgs. The absence of a public exploit does not preclude manual exploitation by malicious actors with privileged access.