{"metadata": {"vulnerability": "CVE-2026-110623", "count": 15, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-02-24T00:00:00Z", "date_only": false, "value": "2026-02-24T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-110623", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-14T13:07:27.788Z", "date_only": false, "value": "2026-10-14T13:07:27.788Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-110623", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T14:16:59.957Z", "date_only": false, "value": "2026-10-14T14:16:59.957Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-110623", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T14:16:59.957Z", "date_only": false, "value": "2026-10-14T14:16:59.957Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-110623", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T15:17:14Z", "date_only": false, "value": "2026-10-14T15:17:14Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-W6CV-8RWH-JRFJ", "record": "GHSA-W6CV-8RWH-JRFJ", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-14T15:17:14.833Z", "date_only": false, "value": "2026-10-14T15:17:14.833", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110623", "record": "FKIE_CVE-2026-110623", "field": "published"}, {"timestamp": "2026-10-14T15:32:26Z", "date_only": false, "value": "2026-10-14T15:32:26Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-W6CV-8RWH-JRFJ", "record": "GHSA-W6CV-8RWH-JRFJ", "field": "published"}, {"timestamp": "2026-10-14T15:32:26Z", "date_only": false, "value": "2026-10-14T15:32:26Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-W6CV-8RWH-JRFJ", "record": "GHSA-W6CV-8RWH-JRFJ", "field": "modified"}, {"timestamp": "2026-10-14T19:30:42.663Z", "date_only": false, "value": "2026-10-14T19:30:42.663804Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117440921091071257", "record": "CVE-2026-110623", "field": "creation_timestamp", "uuid": "aac247f5-87c9-4eb5-9b65-35793396a2e2", "content": "CVE-2026-110623 Papermerge Core through 3.5.3 Missing Authorization in Shared Nodes API Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/{node_id} to grant themselves any role, then read, modify, or delete victims' documents and revoke existing shares.\nhttps://www.cve.org/CVERecord?id=CVE-2026-110623https://github.com/papermerge/papermerge-core/issues/1290https://github.com/papermerge/papermerge-core/issues/1291https://github.com/papermerge/papermerge-core/blob/3.5.3/papermerge/core/features/shared_nodes/router.py#L78-L150https://github.com/papermerge/papermerge-core/commit/0fd469102b05b5ebeb5ee39b3f73ff76991ab269https://www.vulncheck.com/advisories/papermerge-core-through-3.5.3-missing-authorization-in-shared-nodes-api#papermerge #papermerge-core#CVE_2026_110623#bot", "url": "https://infosec.exchange/users/cve/statuses/117440921091071257"}, {"timestamp": "2026-10-15T04:30:04.498Z", "date_only": false, "value": "2026-10-15T04:30:04.498496Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxva2a6o6h2l", "record": "CVE-2026-110623", "field": "creation_timestamp", "uuid": "d5f36d89-338c-4445-9759-11277486621b", "content": "CVE-2026-110623 - papermerge-core\nVersions of Papermerge Core up to 3.5.3 let a logged\u2011in user give themselves access to any document by guessing its internal ID. This could let them read, change\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#papermergecore #papermerge #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxva2a6o6h2l"}, {"timestamp": "2026-10-16T16:35:42.242Z", "date_only": false, "value": "2026-10-16T16:35:42.242876Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-110623", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-16T16:35:42.242Z", "date_only": false, "value": "2026-10-16T16:35:42.242876Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110623", "record": "FKIE_CVE-2026-110623", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-16T17:16:11.037Z", "date_only": false, "value": "2026-10-16T17:16:11.037Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-110623", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T17:16:11.037Z", "date_only": false, "value": "2026-10-16T17:16:11.037Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-110623", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T18:17:32.670Z", "date_only": false, "value": "2026-10-16T18:17:32.670", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110623", "record": "FKIE_CVE-2026-110623", "field": "lastModified"}]}