[
{
"id": "CVE-2026-87739",
"source_identifier": "eb41dac7-0af8-4f84-9f6d-0272772514f4",
"published": "2026-09-24T07:16:34Z",
"last_modified": "2026-09-24T07:16:34Z",
"status": "Received",
"evaluator_comment": null,
"evaluator_solution": null,
"evaluator_impact": null,
"cisa_exploit_add": null,
"cisa_action_due": null,
"cisa_required_action": null,
"cisa_vulnerability_name": null,
"descriptions": [
{
"lang": "en",
"value": "An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report generation requests without valid credentials, an attacker can generate reports and gain unauthorized access to sensitive information."
}
],
"references": [
{
"url": "https://www.papercut.com/kb/Main/security-bulletin-sep-2026/",
"source": "eb41dac7-0af8-4f84-9f6d-0272772514f4",
"tags": null
}
],
"metrics": {
"cvss_metric_v40": [
{
"source": "eb41dac7-0af8-4f84-9f6d-0272772514f4",
"type": "Secondary",
"cvss_data": {
"version": "4.0",
"vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X",
"attack_vector": "NETWORK",
"attack_complexity": "LOW",
"attack_requirements": "NONE",
"privileges_required": "NONE",
"user_interaction": "NONE",
"vulnerable_system_confidentiality": null,
"vulnerable_system_integrity": null,
"vulnerable_system_availability": null,
"subsequent_system_confidentiality": null,
"subsequent_system_integrity": null,
"subsequent_system_availability": null,
"exploit_maturity": "NOT_DEFINED",
"confidentiality_requirements": null,
"integrity_requirements": null,
"availability_requirements": null,
"modified_attack_vector": "NOT_DEFINED",
"modified_attack_complexity": "NOT_DEFINED",
"modified_attack_requirements": "NOT_DEFINED",
"modified_privileges_required": "NOT_DEFINED",
"modified_user_interaction": "NOT_DEFINED",
"modified_vulnerable_system_confidentiality": null,
"modified_vulnerable_system_integrity": null,
"modified_vulnerable_system_availability": null,
"modified_subsequent_system_confidentiality": null,
"modified_subsequent_system_integrity": null,
"modified_subsequent_system_availability": null,
"safety": null,
"automatable": null,
"recovery": null,
"value_density": "NOT_DEFINED",
"vulnerability_response_effort": "NOT_DEFINED",
"provider_urgency": "NOT_DEFINED",
"base_score": 6.9,
"base_severity": "MEDIUM"
}
}
],
"cvss_metric_v31": null,
"cvss_metric_v30": null,
"cvss_metric_v2": null
},
"weaknesses": [
{
"source": "eb41dac7-0af8-4f84-9f6d-0272772514f4",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-639"
}
]
}
],
"configurations": null,
"vendor_comments": null,
"enrichment": {
"cpe": null,
"cwe": [
{
"id": 639,
"owasptop10_2021": "A01 Broken Access Control",
"name": "Authorization Bypass Through User-Controlled Key",
"description": "The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.",
"capec_id": null,
"scope": [
"Access Control"
],
"impact": [
"Bypass Protection Mechanism",
"Gain Privileges or Assume Identity"
],
"detection_method": [
"Automated Static Analysis"
]
}
],
"epss_score": null,
"cisa_kev": null,
"vdeep_metric": {
"available_versions": [
"4.0"
],
"source": "eb41dac7-0af8-4f84-9f6d-0272772514f4",
"type": "Secondary",
"cvss_data": {
"version": "4.0",
"vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X",
"attack_vector": "NETWORK",
"attack_complexity": "LOW",
"attack_requirements": "NONE",
"privileges_required": "NONE",
"user_interaction": "NONE",
"vulnerable_system_confidentiality": null,
"vulnerable_system_integrity": null,
"vulnerable_system_availability": null,
"subsequent_system_confidentiality": null,
"subsequent_system_integrity": null,
"subsequent_system_availability": null,
"exploit_maturity": "NOT_DEFINED",
"confidentiality_requirements": null,
"integrity_requirements": null,
"availability_requirements": null,
"modified_attack_vector": "NOT_DEFINED",
"modified_attack_complexity": "NOT_DEFINED",
"modified_attack_requirements": "NOT_DEFINED",
"modified_privileges_required": "NOT_DEFINED",
"modified_user_interaction": "NOT_DEFINED",
"modified_vulnerable_system_confidentiality": null,
"modified_vulnerable_system_integrity": null,
"modified_vulnerable_system_availability": null,
"modified_subsequent_system_confidentiality": null,
"modified_subsequent_system_integrity": null,
"modified_subsequent_system_availability": null,
"safety": null,
"automatable": null,
"recovery": null,
"value_density": "NOT_DEFINED",
"vulnerability_response_effort": "NOT_DEFINED",
"provider_urgency": "NOT_DEFINED",
"base_score": 6.9,
"base_severity": "MEDIUM"
}
}
}
}
]