CVE-2026-71244: Paperless-ngx Credential Disclosure Flaw

CVE-2026-71244 Overview

CVE-2026-71244 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Paperless-ngx affecting the MailAccountViewSet.test() action. When the endpoint is called with an existing account ID and a masked password field, the application reuses the stored password, account_type, refresh_token, and expiration values. It permits the caller to override imap_server, imap_port, and imap_security in the same request. A user with only object-level change_mailaccount permission can redirect the test connection to an attacker-controlled Internet Message Access Protocol (IMAP) host and receive the real stored credentials.

Critical Impact
Authenticated low-privilege users can exfiltrate stored IMAP passwords or OAuth tokens by pointing the test connection at an attacker-controlled server.

Affected Products

Paperless-ngx document management system
Installations exposing the MailAccountViewSet API endpoint
Deployments granting change_mailaccount object-level permissions to non-admin users

Discovery Timeline

2026-08-05 - CVE-2026-71244 published to the National Vulnerability Database (NVD)
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71244

Vulnerability Analysis

The flaw resides in the test() action of the MailAccountViewSet class in Paperless-ngx. This endpoint validates mail account configurations by performing an IMAP connection with supplied parameters. When the caller submits a request referencing an existing account ID with the password field masked, the server preserves the sensitive fields (password, account_type, refresh_token, expiration) from the persisted record. The server simultaneously accepts caller-supplied values for the imap_server, imap_port, and imap_security fields.

The test connection then authenticates to the caller-specified destination using the real stored credentials. This mismatch between which fields are trusted from the database and which are trusted from the request body creates the exploitable condition.

Root Cause

The root cause is inconsistent input trust boundaries within the test() action. Sensitive authentication material is correctly protected from client override, but connection destination fields are not validated against the stored account. The endpoint should either require an unmasked password when non-default endpoints are supplied, or reject requests that alter connection targets while reusing stored credentials.

Attack Vector

An authenticated attacker holding only change_mailaccount permission on a target account controls an external IMAP listener. The attacker issues a request to the test() action referencing the victim account ID, keeps the password field masked, and substitutes imap_server with their own host. Paperless-ngx retrieves the real password or OAuth token from storage and transmits it to the attacker's listener during the authentication handshake. The vulnerability requires no user interaction and is exploitable over the network.

The vulnerability mechanism is documented via the project source. See the Paperless-ngx GitHub repository for the affected view logic.

Detection Methods for CVE-2026-71244

Indicators of Compromise

Outbound IMAP connections from Paperless-ngx hosts to unexpected external destinations on ports 143, 993, or non-standard IMAP ports
HTTP POST or PATCH requests to /api/mail_accounts/{id}/test/ containing imap_server values that differ from the stored account configuration
Application logs showing successful invocation of the MailAccountViewSet.test() action by non-administrative accounts

Detection Strategies

Inspect Paperless-ngx access logs for test action requests correlated with modifications to imap_server, imap_port, or imap_security fields
Monitor egress network flows from application servers, alerting on IMAP or TLS connections to hosts outside the approved mail server allowlist
Compare request-body IMAP endpoint fields against the values stored in the MailAccount table for the referenced account ID

Monitoring Recommendations

Enable verbose audit logging on the Paperless-ngx REST API and forward events to a centralized SIEM for correlation
Baseline legitimate IMAP destinations used by the application and alert on deviations
Review role assignments granting change_mailaccount permissions and monitor activity from those principals

How to Mitigate CVE-2026-71244

Immediate Actions Required

Upgrade Paperless-ngx to the fixed release once published by the maintainers
Revoke change_mailaccount object-level permissions from non-administrative users until patched
Rotate all IMAP passwords and OAuth refresh tokens stored in Paperless-ngx mail accounts
Restrict outbound network access from the Paperless-ngx host to known mail server destinations only

Patch Information

Refer to the Paperless-ngx GitHub repository for release notes and the corresponding fix commit. Apply the vendor-supplied update to the affected MailAccountViewSet.test() action.

Workarounds

Enforce egress filtering that limits the Paperless-ngx application to outbound connections targeting approved IMAP hosts only
Remove object-level change_mailaccount grants and require full administrative role membership to modify mail account settings
Place the Paperless-ngx API behind an authenticating reverse proxy that blocks requests to the test action from non-admin identities

bash

# Example egress restriction using iptables to allow only approved IMAP hosts
iptables -A OUTPUT -p tcp -d mail.example.com --dport 993 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 993 -j DROP
iptables -A OUTPUT -p tcp --dport 143 -j DROP