CVE-2026-35462

Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, API keys with an expiresAt date are never validated against the current time during authentication. Any API key — regardless of its expiration date — is accepted indefinitely, allowing a user whose key has expired to continue accessing all protected endpoints as if the key were still valid. This vulnerability is fixed in 26.4.0.

• CWE-613

• https://github.com/papra-hq/papra/security/advisories/GHSA-866c-mc22-wvv5Exploit, Vendor Advisory

Published

Apr 7, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35457libp2p-rust is the official rust language Implementation of …8.2
• CVE-2026-35458Gotenberg is an API for converting document formats. In 8.29…9.8
• CVE-2026-35459pyLoad is a free and open-source download manager written in…9.1
• CVE-2026-3546The e-shot form builder plugin for WordPress is vulnerable t…5.3
• CVE-2026-35460Papra is a minimalistic document management and archiving pl…5.4
• CVE-2026-35461Papra is a minimalistic document management and archiving pl…4.3
• CVE-2026-35463pyLoad is a free and open-source download manager written in…8.8
• CVE-2026-35464pyLoad is a free and open-source download manager written in…7.5
• CVE-2026-35465SecureDrop Client is a desktop app for journalists to secure…7.5
• CVE-2026-35466XSS vulnerability in cveInterface.js allows for inject HTML …6.1
• CVE-2026-35467The stored API keys in temporary browser client is not marke…7.5
• CVE-2026-35468nimiq/core-rs-albatross is a Rust implementation of the Nimi…7.5