CVE-2026-120463 Details

A missing authorization vulnerability has been identified in Warracker versions prior to 1.0.4, specifically within its integration with Paperless-ngx. This vulnerability allows authenticated, non-administrative users to bypass document ownership restrictions. By searching for and linking another user's private document ID to a warranty they own, using the 'other' document type, attackers can exploit inadequate authorization checks in the 'paperless_search_and_link()' and 'serve_paperless_document()' route handlers. This exploitation enables the retrieval and disclosure of private documents belonging to other users, using the shared Paperless-ngx API credential, thereby causing unauthorized read access and a loss of confidentiality.

Users are advised to update Warracker to version 1.0.4, where this vulnerability has been patched.