CVE-2026-71244 — Paperless-ngx - Mail Account Test Connection Leaks Stored IMAP/OAuth Credentials to Attacker-Controlled Host

CVE-2026-71244

Paperless-ngx - Mail Account Test Connection Leaks Stored IMAP/OAuth Credentials to Attacker-Controlled Host PUBLISHED

Description (CNA)

Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, account_type, refresh_token, and expiration from that existing account while allowing the caller to supply a different imap_server, imap_port, and imap_security in the same request.

Affected (CNA)

Vendor / product	Versions
paperless-ngx / paperless-ngx	affected 0

CWE

CWE-918

References

https://github.com/paperless-ngx/paperless-ngx

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.