CVE-2026-35462
CVE-2026-35462 is a medium-severity vulnerability in Papra with a CVSS 3.x base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-613.
Key facts
- Severity: Medium (CVSS 3.x base score 4.3)
- EPSS exploit prediction: 0% (15th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-19657
- Weakness: CWE-613
- Affected product: Papra
- Published:
- Last modified:
Description
Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, API keys with an expiresAt date are never validated against the current time during authentication. Any API key — regardless of its expiration date — is accepted indefinitely, allowing a user whose key has expired to continue accessing all protected endpoints as if the key were still valid. This vulnerability is fixed in 26.4.0.
Frequently asked questions
- What is CVE-2026-35462?
- Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, API keys with an expiresAt date are never validated against the current time during authentication. Any API key — regardless of its expiration date — is accepted indefinitely, allowing a user whose key has expired to continue accessing all protected endpoints as if the key were still valid. This vulnerability is fixed in 26.4.0.
- How severe is CVE-2026-35462?
- CVE-2026-35462 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
- Is CVE-2026-35462 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (15th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-35462?
- CVE-2026-35462 affects Papra. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2026-35462?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2026-35462 have an EU (EUVD) identifier?
- Yes. CVE-2026-35462 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-19657.
- When was CVE-2026-35462 published?
- CVE-2026-35462 was published on 2026-04-07 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:papra:papra:*:*:*:*:*:*:*:*
More vulnerabilities in Papra
- CVE-2026-35461 — Medium (CVSS 5.0): Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, the Papra webhook system allows…
- CVE-2026-35460 — Medium (CVSS 4.3): Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, transactional email templates in…
Other CWE-613 (Insufficient Session Expiration) vulnerabilities
- CVE-2024-8888 — Critical (CVSS 10.0): An attacker with access to the network where CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could steal the…
- CVE-2026-46455 — Critical (CVSS 9.8): Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component. The camel-keycloak security helper…
- CVE-2026-21622 — Critical (CVSS 9.8): Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Accounts.PasswordReset' module)…
- CVE-2025-59786 — Critical (CVSS 9.8): 2N Access Commander version 3.4.2 and prior improperly invalidates session tokens, allowing multiple session cookies to…
- CVE-2026-26342 — Critical (CVSS 9.8): Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior implement an authentication token…
- CVE-2026-1435 — Critical (CVSS 9.8): Not properly invalidated session vulnerability in Graylog Web Interface, version 2.2.3, due to incorrect management of…
Browse all CWE-613 (Insufficient Session Expiration) vulnerabilities →