Is CVE-2026-111350 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-111350?

CVE-2026-111350 has a CVSS v3 severity of MEDIUM (5).

Back

CVE-2026-111350

Description

Papermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer group API that allows authenticated users to delete other teams' viewer groups and share links. Attackers who know a victim team's data room and group identifiers can send DELETE requests, read group links, or rewrite group document permissions across teams.