Missing Authorization Vulnerability in Warracker Affects Paperless-ngx Integration
CVE-2026-120463

6MEDIUM

Key Information:

Vendor

Sassanix

Status
Warracker
Vendor
CVE Published:
2 November 2026

What is CVE-2026-120463?

The Warracker application prior to version 1.0.4 contains a vulnerability that allows authenticated, non-administrative users to bypass document ownership restrictions through the Paperless-ngx integration. Exploiting this vulnerability lets attackers use insufficient authorization checks to link another user's private document ID to their own warranty, thereby gaining unauthorized read access to sensitive documents. This could result in serious confidentiality breaches through the shared Paperless-ngx API credentials.

Affected Version(s)

Warracker 1.0.0 < 1.0.4

References

https://github.com/sassanix/Warracker/security/advisories...
vendor-advisorytechnical-description
https://github.com/sassanix/Warracker/releases/tag/1.0.4
patchissue-tracking
https://www.vulncheck.com/advisories/warracker-before-mis...
third-party-advisory

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Azizbek Tursunov
.