CVE-2024-35184
paperless-ngx's remote user auth via header works even when disabling it for API
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
paperless-ngx's remote user auth via header works even when disabling it for API
Paperless-ngx is a document management system that transforms physical documents into a searchable online archive. Starting in version 2.5.0 and prior to version 2.8.6, remote user authentication allows API access even if API access is explicitly disabled. Version 2.8.6 contains a patchc for the issue.
Reserved 2024-05-10 | Published 2024-05-15 | Updated 2024-08-02 | Assigner GitHub_MCWE-287: Improper Authentication
github.com/...ss-ngx/security/advisories/GHSA-72w4-hxqq-c256
github.com/paperless-ngx/paperless-ngx/pull/6739
github.com/...ommit/ed05b40ba461641b1b59b0a92f51f3f6a66ce180
github.com/paperless-ngx/paperless-ngx/releases/tag/v2.8.6
Support options
