Insufficient Verification of Data Authenticity Affecting @paperclipai/shared package, versions <2026.416.0
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-PAPERCLIPAISHARED-16421457
- published5 May 2026
- disclosed16 Apr 2026
- creditoffset
Introduced: 16 Apr 2026
New CVE NOT AVAILABLE CWE-345 (opens in a new tab)How to fix?
Upgrade @paperclipai/shared to version 2026.416.0 or higher.
Overview
Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the decidedByUserId field in approval-related endpoints. An attacker can forge decision attribution by supplying an arbitrary user identifier in the request body, causing the system to record actions as if performed by another legitimate user. This can undermine the integrity of governance and audit trails, allowing a user to falsely attribute approval, rejection, or revision requests to others.
Note: This is only exploitable if the attacker is an authenticated board user with access to the target company.