Vulnerability · Published Apr 7, 2026 · Assigned by GitHub_M

CVE-2026-35462Papra Does Not Reject Expired API Keys

Medium 4.3

In plain English

A medium-severity security flaw in papra from papra-hq. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 83.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, API keys with an expiresAt date are never validated against the current time during authentication. Any API key — regardless of its expiration date — is accepted indefinitely, allowing a user whose key has expired to continue accessing all protected endpoints as if the key were still valid. This vulnerability is fixed in 26.4.0.

Affected products (as reported)

Vendor	Product	Versions
papra-hq	papra	< 26.4.0

Weakness: CWE-613 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/papra-hq/papra/security/advisories/GHSA-866c-mc22-wvv5 x_refsource_CONFIRM