Missing Authorization Vulnerability in Papermark Data Room Viewer API

CVE-2026-111350

What is CVE-2026-111350?

Papermark versions up to 0.22.0 are susceptible to a vulnerability in the data room viewer group API that lacks proper authorization mechanisms. This flaw permits authenticated users to delete viewer groups and share links associated with other teams' data rooms. If an attacker knows the identifiers for a victim team's data room and group, they can exploit this vulnerability to issue DELETE requests, access group links, and alter permissions on documents across different teams, potentially leading to unauthorized data exposure and manipulation.

References