Skip to content
Log inStart free trial

CVE-2026-81578

An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG.

High Known exploited
Severity
8.8 / 10
High · CVSS 4.0
Exploit chance (EPSS)
84.73%
Chance of exploitation in the next 30 days. Higher than 99.71% of scored vulnerabilities.
Known exploited
Yes
In CISA's catalog since Aug 31, 2026
Weakness
CWE-305 Authentication Bypass by Primary Weakness
Fix
None yet
No fixed version published
Exploited in the wild. PaperCut NG/MF Missing Authentication for Critical Function Vulnerability (PaperCut NG/MF). Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Due for U.S. federal agencies by Sep 14, 2026.

Description

An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.

How to fix

No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.

Severity breakdown

CVSS 4.0 8.8

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack vector
Network
Attack complexity
Low
Attack requirements
None
Privileges required
None
User interaction
None
Confidentiality (vulnerable system)
Low
Integrity (vulnerable system)
High
Availability (vulnerable system)
Low
Confidentiality (subsequent systems)
None
Integrity (subsequent systems)
None
Availability (subsequent systems)
None
Exploit maturity
Not defined
Scope
X

CVSS 3.1 9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Weakness

CWE-305: Authentication Bypass by Primary Weakness

The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.

References

Advisories

Fixes and patches

Timeline

  1. Published
  2. Added to CISA's Known Exploited Vulnerabilities catalog
  3. Remediation due for U.S. federal agencies
  4. Last updated by the source
  5. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-45gv-9wjv-xh7p
Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)
High Same weakness, CWE-305
EEF-CVE-2026-85500
`require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication
Not rated yet Same weakness, CWE-305
GHSA-vx8h-4prv-g744
Rancher has Privilege Escalation from Project Owner to Host
High Same weakness, CWE-305
GHSA-q6h7-xxp7-7429
Keycloak has an Authentication Bypass by Primary Weakness
Medium Same weakness, CWE-305
GHSA-jp3f-x449-4q75
Mattermost doesn't enforce client identity binding during the OAuth authorization code redemption flow
Low Same weakness, CWE-305
GHSA-75cm-x2w3-8mgf
MLflow: unauthenticated access to certain FastAPI routes
High Same weakness, CWE-305
GHSA-phrq-pc6r-f6gh
MantisBT is vulnerable to authentication bypass through the SOAP API on MySQL
Critical Same weakness, CWE-305
GHSA-v9xm-ffx2-7h35
ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware
High Same weakness, CWE-305
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor