Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-71244— Paperless-ngx - Mail Account Test Connection Leaks Stored IMAP/OAuth Credentials to Attacker-Controlled Host

Quick assessment

Affected
paperless-ngx paperless-ngx
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Paperless-ngx是paperless-ngx组织开源的一个文档管理系统。 Paperless-ngx存在服务端请求伪造漏洞，该漏洞源于MailAccountViewSet.test()接口在调用时复用已有账户的存储密码、账户类型、刷新令牌和过期时间，并允许调用者指定不同的IMAP服务器、端口和安全性设置，仅拥有对象级change_mailaccount权限的用户可将测试连接重定向至攻击者控制的IMAP主机，导致真实存储的IMAP密码或OAuth令牌被发送至该主机。

CVSS 6.5 · Medium EPSS 0.20% · P10

Possible ATT&CK Techniques 1 AI

T1530 · Data from Cloud Storage

Affected Version Matrix 1

VendorProduct Version RangeStatus
paperless-ngx paperless-ngx affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-71244

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Paperless-ngx - Mail Account Test Connection Leaks Stored IMAP/OAuth Credentials to Attacker-Controlled Host
Source: CVE Program / CVE List V5
Vulnerability Description
Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, account_type, refresh_token, and expiration from that existing account while allowing the caller to supply a different imap_server, imap_port, and imap_security in the same request.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Vulnerability Title
Paperless-ngx 服务端请求伪造漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Paperless-ngx是paperless-ngx组织开源的一个文档管理系统。 Paperless-ngx存在服务端请求伪造漏洞，该漏洞源于MailAccountViewSet.test()接口在调用时复用已有账户的存储密码、账户类型、刷新令牌和过期时间，并允许调用者指定不同的IMAP服务器、端口和安全性设置，仅拥有对象级change_mailaccount权限的用户可将测试连接重定向至攻击者控制的IMAP主机，导致真实存储的IMAP密码或OAuth令牌被发送至该主机。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
paperless-ngx paperless-ngx 0 -

II. Public POCs for CVE-2026-71244

# POC Description Source Link Shenlong Link
AI-Generated POC Verified env Premium
Reproduced successfully in a real sandbox · Below is the actual recording of building the environment and exploiting the vulnerability.
Reproduction recording is a Pro+ exclusive
Watch the full sandbox build + live exploit recording for this CVE. Limited-time ¥499/mo.
Upgrade to Pro+
claude_code · 8258 chars
GitHub 复现环境（可 clone 直接跑）
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-71244

请登录查看更多情报信息。

Vendor Pages for CVE-2026-71244 (1)

IV. Related Vulnerabilities

Same product: paperless-ngx
Same vendor: paperless-ngx
Same weakness: CWE-918

V. Comments for CVE-2026-71244

No comments yet

Leave a comment