CVE-2026-35462
Medium
Description
Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, API keys with an expiresAt date are never validated against the current time during authentication. Any API key — regardless of its expiration date — is accepted indefinitely, allowing a user whose key has expired to continue accessing all protected endpoints as if the key were still valid. This vulnerability is fixed in 26.4.0.
SeverityMedium
CVSS4.3
Exploit probability—
ProductPapra
PublishedApr 7, 2026
First seenApr 7, 2026
Weakness typeCWE-613CWE-613
How to fix
Update
- papra papra26.4.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| papra papra | v < 26.4.0 | 26.4.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.