CVE-2026-48052 Details
Description
Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, an authenticated user who is a member of any organization can delete or rename tags belonging to a different organization, given the target tag's ID. The route handler verifies the caller's membership of the ":organizationId" in the URL, but the repository write filters on tag.id alone, so the URL-level org scope never reaches the database. This issue has been patched in version 26.5.0.
A vulnerability in Papra, a document management and archiving platform, allows authenticated users to delete or rename tags belonging to different organizations. This issue affects Papra versions through 26.4.0. The vulnerability arises because the application verifies organizational membership at the URL level but only filters tag IDs in the repository write process. As a result, the organizational scope does not reach the database, enabling cross-organization tag manipulation.
Users should update to Papra version 26.5.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 27, 2026CISA-ADP
Assessed Jul 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/papra-hq/papra/commit/47d44e0681bf59da0638b140d1c5ef5b970f6b67 | [email protected] | Source CodeVendor |
| https://github.com/papra-hq/papra/pull/1080 | [email protected] | Issue TrackingVendor |
| https://github.com/papra-hq/papra/security/advisories/GHSA-wrx4-3vff-jm94 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Papra | <= 26.4.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 27, 2026 | CVE Modified | CISA-ADP |
| Jul 27, 2026 | New CVE Received | [email protected] |