Description (CNA)
Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, API keys with an expiresAt date are never validated against the current time during authentication. Any API key — regardless of its expiration date — is accepted indefinitely, allowing a user whose key has expired to continue accessing all protected endpoints as if the key were still valid. This vulnerability is fixed in 26.4.0.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| papra-hq / papra | affected < 26.4.0 |
CWE
CWE-613
References
ADP enrichment
No English description supplied.
No references supplied.