CVE-2026-81578
PaperCut MF/NG: Authentication Bypass
En bref
- Source
- NVD
- EPSS
- EPSS 83.73 % · centile 100 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- PaperCut
- Statut NVD
- Analyzed
Description
An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.
Faiblesses (CWE)
- CWE-305 — Contournement d'authentification par faiblesse primaire
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 4.0 | HIGH 8.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N | PaperCut |
| CVSS 4.0 | HIGH 8.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · eb41dac7-0af8-4f84-9f6d-0272772514f4 (Secondary) |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2026-67713
- GCVE · GCVE-0-2026-81578
Avis du CERT-FR
- CERTFR-2026-AVI-1095 — Multiples vulnérabilités dans Papercut · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*< 24.1.9cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*≥ 25.0.2 < 25.0.12cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*≥ 26.0.2 < 26.0.4cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*< 24.1.9cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*≥ 25.0.2 < 25.0.12cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*≥ 26.0.2 < 26.0.4
Produits affectés
| Produit | Versions |
|---|---|
| PaperCut · PaperCut MF/NG | affected 0 < 24.1.10 ; affected 25.0.0 < 25.0.13 ; affected 26.0.0 < 26.0.5 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |