All vulnerabilities
CVE-2026-87739

PaperCut MF/NG: User permissions are not evaluated on report generation

PaperCut PaperCut NG/MF
Open in ThreatlineRecord JSON
CVSS
6.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.38%Chance of exploitation activity in the next 30 days, higher than 30% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in24.1.10Also 25.0.13, 26.0.5CVE List
Published24 Sep 2026Updated 13 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report generation requests without valid credentials, an attacker can generate reports and gain unauthorized access to sensitive information.

Text from CVE List

Affected versions 3

  • PaperCut NG/MFaffected: all versions before 24.1.10CVE List
  • PaperCut NG/MFaffected: 25.0.0 before 25.0.13CVE List
  • PaperCut NG/MFaffected: 26.0.0 before 26.0.5CVE List

References 1