Paperless-ngx’s MailAccountViewSet.test() action allows a caller to request a test connection using an existing account’s stored password, refresh token, and expiration while directing the connection to a host of the caller’s choosing. The action reuses the stored credentials and authenticates to the supplied IMAP server, effectively leaking the IMAP/OAuth credentials to that host. This constitutes an outbound credential disclosure (CWE‑918) that gives an attacker a copy of a user’s private authentication data. The primary impact is the theft of IMAP or OAuth credentials, which an attacker could then use to impersonate the legitimate user on the target mail system or to compromise other services that rely on those credentials. Because the credentials are sent to an external host controlled by the attacker, confidentiality is fully compromised. The attack can be carried out remotely via the API by a user who has object‑level change_mailaccount permission on a target account. No system‑wide privileges or administrative access are required, and the exploit requires only the ability to send the test request and to specify a destination host.

Paperless‑ngx, all installed instances where the MailAccountViewSet.test() action is available. No specific product versions are listed; the issue applies to every version that retains the current logic.

The CVSS score of 7.1 indicates a moderate‑to‑high severity vulnerability. With the EPSS score not available, the probability of exploitation is uncertain but the known functionality of the API makes such an attack feasible. The vulnerability is not listed in the CISA KEV catalog, but its straightforward exploitation path and the sensitivity of the data leaked make it a serious concern. The likely attack vector is a remote API call that a possessing user can trigger.