https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 13:53:32 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-71244 <p>Paperless-ngx&#39;s MailAccountViewSet.test action, when called with an existing account&#39;s ID and a masked password field, reuses the stored password, account_type, refresh_token, and expiration from that existing account while allowing the caller to supply a different imap_server, imap_port, and imap_security in the same request.</p> <p>Paperless-ngx&#39;s MailAccountViewSet.test action, when called with an existing account&#39;s ID and a masked password field, reuses the stored password, account_type, refresh_token, and expiration from that existing account while allowing the caller to supply a different imap_server, imap_port, and imap_security in the same request.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-71244 https://vulnerability.circl.lu/vuln/ghsa-666w-8983-6664 <p>Paperless-ngx&#39;s MailAccountViewSet.test() action, when called with an existing account&#39;s ID and a masked password field, reuses the stored password, account_type, refresh_token, and expiration from that existing account while allowing the caller to supply a different imap_server, imap_port, and imap_security in the same request. The test connection then authenticates to the caller-specified server using the real stored credentials. A user holding only object-level change_mailaccount permission on the target account (not full admin) can redirect the test connection to an attacker-controlled IMAP host, causing the real stored IMAP password or OAuth token to be sent to that host.</p> <p>Paperless-ngx&#39;s MailAccountViewSet.test() action, when called with an existing account&#39;s ID and a masked password field, reuses the stored password, account_type, refresh_token, and expiration from that existing account while allowing the caller to supply a different imap_server, imap_port, and imap_security in the same request. The test connection then authenticates to the caller-specified server using the real stored credentials. A user holding only object-level change_mailaccount permission on the target account (not full admin) can redirect the test connection to an attacker-controlled IMAP host, causing the real stored IMAP password or OAuth token to be sent to that host.</p> https://vulnerability.circl.lu/vuln/ghsa-666w-8983-6664