Paperless-ngx’s MailAccountViewSet.test action, when invoked with a stored account ID and a masked password field, reuses the account’s stored password, account type, refresh token, and expiration while allowing the caller to override the IMAP server, port and security settings. As a result, the application connects to an attacker‑specified IMAP endpoint using those authentic credentials, leaking the IMAP or OAuth credentials to the chosen host.

All installed instances of paperless‑ngx that expose the MailAccountViewSet.test() API endpoint are susceptible. No specific product version is identified, so the issue applies to every release that maintains the current implementation.

With a CVSS score of 6.5 and an EPSS score of less than 1%, the vulnerability represents a moderate severity risk that is unlikely to be widely exploited but still poses a serious concern. The key risk is the disclosure of stored IMAP/OAuth credentials, which could enable an attacker to impersonate the legitimate user on the mail system or leverage those credentials against other services. The likely attack vector is a remote API call to the test endpoint by an authenticated user capable of invoking the action; no administrative privileges beyond standard API access are required according to the description provided.