CVE-2026-82472CWE-306

CVE-2026-82472

High · published August 29, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
54.6
In the wild
Unconfirmed
What it is

Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked document records.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00755 · 54.6th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-08-29T21:17Z
References (4)
https://github.com/documenso/documenso · [email protected]https://github.com/documenso/documenso/blob/v2.12.0/apps/remix/server/api/files/files.ts · [email protected]https://github.com/documenso/documenso/commit/4f346d3c2d5264f221e4d787e162f16051e44114 · [email protected]https://www.vulncheck.com/advisories/documenso-before-2.13.0-unauthenticated-file-upload-via-api-files-upload-pdf · [email protected]
EPSS history
Timeline
  • 30 AUG 16:19Z
    EPSS moved — → 0%
    epss
  • 29 AUG 16:35Z
    Documenso before 2.13.0 Unauthenticated File Upload via /api/files/upload-pdf
    cvelistv5