PaperCut MF/NG suffers from an improper authentication flaw that lets an attacker trigger the report generation function without providing valid credentials. The flaw is a classic authorization bypass described as CWE‑639. By abusing this vulnerability the attacker can create reports that may contain confidential or sensitive information such as user data, print jobs, or internal metrics, thereby exposing data that should be protected.

Affected products are PaperCut NG and PaperCut MF. No specific version numbers are supplied in the advisory, so all deployed instances of these products are potentially impacted until a patch that enforces proper permissions is applied.

The CVSS score of 6.9 places the vulnerability in the medium severity range, while the EPSS score is not reported. The attack vector is inferred as remote, unauthenticated, over the network. Although the flaw does not allow arbitrary code execution, the ability to retrieve supervised data without authorization poses a considerable threat to confidentiality. Given that the vulnerability is not listed in the CISA KEV catalog, the likelihood of current exploitation may be lower, but the moderate severity warrants prompt attention.