CVE-2026-35462
MEDIUM
NVD
CVSS Score
4.3
Severity
MEDIUM
Published
Apr 07, 2026
Vendor
unknown
Description
Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, API keys with an expiresAt date are never validated against the current time during authentication. Any API key — regardless of its expiration date — is accepted indefinitely, allowing a user whose key has expired to continue accessing all protected endpoints as if the key were still valid. This vulnerability is fixed in 26.4.0.