CVE-2026-82472

Documenso before 2.13.0 exposes its /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials (CWE-306, missing authentication for a critical function). Any unauthenticated attacker who can reach the endpoint over the network can submit arbitrary PDF files repeatedly and without limit. By uploading files indefinitely, the attacker can exhaust server storage and fill the database with unlinked document records, producing a denial-of-service condition; per the CVSS 4.0 vector (8.7, high, VA:H), the impact is confined to availability with no confidentiality or integrity effect. Any deployment of Documenso prior to 2.13.0 whose upload endpoint is network-reachable, particularly internet-exposed self-hosted instances, is affected. No public proof-of-concept, KEV listing, or known exploitation exists, and EPSS puts 30-day exploitation probability at only 0.4%, although the flaw is trivially exploitable with basic HTTP requests.

What to do: Upgrade to Documenso 2.13.0 or later. Until then, restrict access to /api/files/upload-pdf at a reverse proxy or firewall (require authentication or an IP allowlist) and/or rate-limit uploads, and monitor disk usage and database growth for signs of abuse. Review upload and web-server logs for unauthenticated requests to that endpoint to check for prior exploitation.