What’s Vulnerable › Vulnerabilities
CVE-2026-35462: Papra Does Not Reject Expired API Keys
- Severity: medium (CVSS 4.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-04-07 · updated 2026-06-17
- Weakness: CWE-613
Description
Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, API keys with an expiresAt date are never validated against the current time during authentication. Any API key — regardless of its expiration date — is accepted indefinitely, allowing a user whose key has expired to continue accessing all protected endpoints as if the key were still valid. This vulnerability is fixed in 26.4.0.
Affected products
- papra-hq papra: before 26.4.0 — fixed in 26.4.0
How to fix
Upgrade to a fixed version: papra-hq papra 26.4.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-35462 or the next vulnerability affects your stack