CVE-2026-111350
Low · CVSS 2.3Published 2026-10-15
CVSS
2.3
Low
EPSS
—
exploit probability
Active Exploit
No
not yet listed
Low — routine — Low severity. Handle in normal patch cycle.
What is CVE-2026-111350?
Papermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer group API that allows authenticated users to delete other teams' viewer groups and share links. Attackers who know a victim team's data room and group identifiers can send DELETE requests, read group links, or rewrite group document permissions across teams.
CVSS Score Explained
CVSS 2.3 is Low severity. Impact is limited and exploitation is difficult. Patch when convenient.
EPSS Exploitation Probability
No EPSS score yet — model needs more data on this CVE.
References & Patches
- ›https://github.com/papermark/papermark
- ›https://github.com/papermark/papermark/blob/v0.22.0/pages/api/teams/%5BteamId%5D/datarooms/%5Bid%5D/groups/%5BgroupId%5D/index.ts#L155-L190
- ›https://github.com/papermark/papermark/blob/v0.22.0/pages/api/teams/%5BteamId%5D/datarooms/%5Bid%5D/groups/%5BgroupId%5D/links.ts#L52-L56
- ›https://github.com/papermark/papermark/commit/7fa52b23944823a9e74402fca8e48d644239bc0b
- ›https://github.com/papermark/papermark/commit/b81cf62f390cda112f35538eb09e54b5f728b74a
- ›https://hackmd.io/@hieuPenguinnn/papermark-dataroom-group-delete-missing-authz
- ›https://www.vulncheck.com/advisories/papermark-through-0.22.0-missing-authorization-in-data-room-viewer-group-api
Track vulnerabilities for your stack
Tell us what tech you run — Node.js, Python, Java, nginx, whatever — and get a weekly email when new CVEs affect it.
Recent CVEs
- CVE-2026-8311Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2026-5819Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2026-2937Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2026-107316Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2026-107172Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2025-3778Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—