CVE-2026-87739 — PaperCut MF/NG: User permissions are not evaluated on report generation

CVE-2026-87739

PaperCut MF/NG: User permissions are not evaluated on report generation PUBLISHED

Description (CNA)

An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report generation requests without valid credentials, an attacker can generate reports and gain unauthorized access to sensitive information.

Affected (CNA)

Vendor / product	Versions
PaperCut / PaperCut NG/MF	affected 0 before 24.1.10; affected 25.0.0 before 25.0.13; affected 26.0.0 before 26.0.5

CWE

CWE-639

References

https://www.papercut.com/kb/Main/security-bulletin-sep-2026/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.