CVE-2026-35462

EUVD-2026-19657 · Published Apr 7, 2026

Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, API keys with an expiresAt date are never validated against the current time during authentication. Any API key — regardless of its expiration date — is accepted indefinitely, allowing a user whose key has expired to continue accessing all protected endpoints as if the key were still valid. This vulnerability is fixed in 26.4.0.

Technologies

Papra Papra

Weaknesses

CWE-613

CVSS scores

v3.14.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access

T1190Exploit Public-Facing Application

References

https://github.com/papra-hq/papra/security/advisories/GHSA-866c-mc22-wvv5

Potentially impacted assets

See if this affects your attack surface