{"id":"CVE-2026-120463","title":"Warracker before 1.0.4 Missing Authorization via Paperless-ngx Document Linking","summary":"Warracker before 1.0.4 contains a missing authorization vulnerability in its Paperless-ngx integration that allows an authenticated, non-administrative user to bypass document ownership restrictions by searching for and linking another u…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-862"],"vendor":"sassanix","product":"Warracker","affected":["Warracker >= 1.0.0 < 1.0.4"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T21:32:40.669386Z"},"exploitAvailable":true,"published":"2026-11-02","updated":"2026-11-05","sourceUpdated":"2026-11-05T21:33:12.914Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-120463","references":[{"url":"https://github.com/sassanix/Warracker/security/advisories/GHSA-3h89-rqfj-5674","label":"Vendor Advisory"},{"url":"https://github.com/sassanix/Warracker/releases/tag/1.0.4","label":"Vendor Patch"},{"url":"https://www.vulncheck.com/advisories/warracker-before-missing-authorization-via-paperless-ngx-document-linking","label":"VulnCheck Advisory: Warracker before 1.0.4 Missing Authorization via Paperless-ngx Document Linking"}],"tags":["cve.org","exploit-available"],"epss":0.00312,"epssPercentile":0.24281,"ingestedAt":"2026-11-05T19:30:42.640Z","slug":"CVE-2026-120463","body":"## Overview\n\nWarracker before 1.0.4 contains a missing authorization vulnerability in its Paperless-ngx integration that allows an authenticated, non-administrative user to bypass document ownership restrictions by searching for and linking another user's private document ID to a warranty they own using the `other` document type. Attackers can exploit insufficient authorization checks in the `paperless_search_and_link()` and `serve_paperless_document()` route handlers in file_routes.py to retrieve and disclose private documents belonging to another user via the shared Paperless-ngx API credential, resulting in unauthorized read access and confidentiality loss.\n\n## Affected\n\n- `Warracker >= 1.0.0 < 1.0.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":234882,"id":"CVE-2026-120463","ts":1793918467748,"field":"exploit_available","old":"false","new":"true"}]}