Live › vulnerability › CVE-2026-120463
Warracker before 1.0.4 has a missing authorization check in its Paperless-ngx integration. A logged-in non-admin user can link another user's private document to their own warranty and then read that document.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 14:23 UTC. All times on this page are UTC.
Teams that self-host Warracker with the Paperless-ngx integration enabled and have more than one user account. The sources say the flaw needs an authenticated, non-administrative user and does not describe exposure without that integration. Single-user deployments or deployments without Paperless-ngx are unlikely to be exposed.
No product ranges from the sources yet.
1.0.4 are affected.1.0.4 or later, per the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Warracker before 1.0.4 contains a missing authorization vulnerability in its Paperless-ngx integration that allows an authenticated, non-administrative user to bypass document ownership restrictions by searching for and linking another user's private document ID to a warranty they own using the other document type. Attackers can exploit insufficient authorization checks in the paperless_search_and_link() and serve_paperless_document() route handlers in file_routes.py to retrieve and disclose private documents belonging to another user via the shared Paperless-ngx API credential, resulting in unauthorized read access and confidentiality loss.
This page as .md · .json · in your agent: get_signal("CVE-2026-120463")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.