CVE-2026-71244 Details

A vulnerability in the Paperless-ngx application allows for the unauthorized disclosure of IMAP credentials. This issue arises in the MailAccountViewSet.test() action, where a user can send a request with an existing account's ID and a masked password field. The action then reuses the stored password, account type, refresh token, and expiration from the existing account. While doing so, it allows the caller to specify a different IMAP server, port, and security settings. This combination enables a user with object-level change_mailaccount permission (but not full admin rights) to redirect the test connection to an attacker-controlled IMAP host, thereby leaking the actual stored IMAP password or OAuth token to that host.