CVE-2024-35184
paperless-ngx's remote user auth via header works even when disabling it for API
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
paperless-ngx's remote user auth via header works even when disabling it for API
| Assigner | GitHub_M |
| Reserved | 2024-05-10 |
| Published | 2024-05-15 |
| Updated | 2024-08-02 |
Paperless-ngx is a document management system that transforms physical documents into a searchable online archive. Starting in version 2.5.0 and prior to version 2.8.6, remote user authentication allows API access even if API access is explicitly disabled. Version 2.8.6 contains a patchc for the issue.
| CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L |
CWE-287: Improper Authentication
https://github.com/paperless-ngx/paperless-ngx/security/advisories/GHSA-72w4-hxqq-c256
https://github.com/paperless-ngx/paperless-ngx/pull/6739
https://github.com/paperless-ngx/paperless-ngx/commit/ed05b40ba461641b1b59b0a92f51f3f6a66ce180
https://github.com/paperless-ngx/paperless-ngx/releases/tag/v2.8.6
