Improper Authentication in Paperless-ngx by Paperless-ngx

CVE-2026-71244

What is CVE-2026-71244?

The MailAccountViewSet.test() action in Paperless-ngx allows attackers to exploit a flaw where an existing account's ID and masked password can lead to the reuse of sensitive credentials. When a target user with limited permissions invokes this action, they can specify a different IMAP server while reusing the actual credentials from a legitimate account. This misconfiguration enables the possibility of redirecting the connection to a malicious IMAP server, which can result in the disclosure of the stored IMAP password or OAuth token to an unauthorized entity.

References