CVE-2026-81578 Details.
PaperCut NG/MF <=26.0.4 - Unauthenticated ConfigEditor Access via Tapestry Complex-Direct
Atlas does not check this one. Needs requests that change data.
To test for this one, the check would have to send requests that could change data on the site. Atlas only ever reads public pages, so it does not run this check.
About CVE-2026-81578. What It Means.
PaperCut NG and PaperCut MF versions 24.x through 26.x contain an authentication bypass vulnerability in the Apache Tapestry-based web interface. By crafting a complex-direct service request that specifies the public Home page as the render target while invoking the privileged ConfigEditor page's form listeners, an unauthenticated remote attacker can search and modify server configuration options. PaperCut's access control validates the render page but fails to validate the…
Affected Product. What Is Hit.
- Vendor
- papercut
- Product
- PaperCut Ng,papercut MF
References. Where To Read More.
FAQ
Common Questions.
PaperCut NG/MF <=26.0.4 - Unauthenticated ConfigEditor Access via Tapestry Complex-Direct. PaperCut NG and PaperCut MF versions 24.x through 26.x contain an authentication bypass vulnerability in the Apache Tapestry-based web interface. By crafting a complex-direct service request that specifies the public Home page as the render target while invoking the privileged ConfigEditor page's form listeners, an unauthenticated remote attacker can search and modify server configuration options. PaperCut's access control validates the render page but fails to validate the…
No. To test for this one, the check would have to send requests that could change data on the site. Atlas only ever reads public pages, so it does not run this check. The facts about CVE-2026-81578 are on this page, and you can request a demo to see how Brandefense watches your whole external attack surface.
Yes. CVE-2026-81578 is on the CISA Known Exploited Vulnerabilities list, which means attackers have used it against real targets.
Update PaperCut Ng,papercut MF to the latest version from the vendor, or follow the vendor's advice to switch off the affected feature. Vendor links are listed on this page when they are known.
This page lists the public facts about CVE-2026-81578. Atlas does not run a check for it, so nothing here says whether a particular site is affected.