CVE-2024-35184

paperless-ngx's remote user auth via header works even when disabling it for API

5.5 Medium

Paperless-ngx is a document management system that transforms physical documents into a searchable online archive. Starting in version 2.5.0 and prior to version 2.8.6, remote user authentication allows API access even if API access is explicitly disabled. Version 2.8.6 contains a patchc for the issue.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: Low

Exploit likelihood

0.49%Up 0.4 points since May 16, 2024

What each source reports

CVE List Score used 5.5

paperless-ngx's remote user auth via header works even when disabling it for API

Record: CVE-2024-35184
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Weakness: CWE-287
Updated: 2026-11-02

EUVDEUVD-2024-35229 5.5

Record: EUVD-2024-35229
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Updated: 2026-11-03

NVD 5.5

Record: CVE-2024-35184
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Weakness: CWE-287
Updated: 2026-11-02

OSV 5.5

paperless-ngx's remote user auth via header works even when disabling it for API

Record: CVE-2024-35184
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Weakness: CWE-287
Updated: 2026-11-02

Affected products

paperless-ngx

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-35184 is a medium vulnerability (CVSS 5.5) in Paperless-ngx, published May 15, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. No source names a fixed version.