CVE-2024-1222: PaperCut NG/MF API privilege escalation via crafted request

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no authentication or user interaction required and a very high EPSS score, though no KEV listing or known exploitation is documented.

What it is

A subset of PaperCut NG and MF API calls can be reached with a maliciously formed request that grants an API authorization level with elevated privileges. Because the flaw is an unnecessary-privilege issue in the API layer, an unauthenticated network attacker can obtain high-privilege API access, making it a serious exposure for exposed print-management servers.

Impact

An attacker gains API access at an elevated authorization level, enabling actions reserved for higher-privileged accounts. The CVSS vector indicates high confidentiality, integrity and availability impact.

Attack surface

Reached over the network through the PaperCut NG/MF API; the CVSS vector shows no authentication (PR:N) and no user interaction (UI:N) required. Only a small subset of API calls is affected per the description.

Exploitation

Not listed in CISA KEV and no public exploit or ransomware use is documented in the record; EPSS is high at roughly 0.64 (99th percentile), indicating elevated likelihood of attempted exploitation.

What to do

• Apply the vendor fix from the PaperCut March 2024 security bulletin for NG/MF.
• Restrict network access to PaperCut API endpoints to trusted hosts or management networks.
• Audit and reduce API accounts and tokens to the minimum privilege needed.
• Monitor PaperCut logs for anomalous API calls and privilege changes after patching.
• If patching is delayed, isolate or take the affected API service offline where operationally possible.

Detection

• Review PaperCut API and application logs for requests that result in elevated authorization levels or unexpected privileged actions.
• Alert on API calls from unfamiliar source IPs or user agents, especially to the affected subset of endpoints.
• Baseline normal API call patterns and flag deviations in volume, timing or endpoint mix.
• Correlate PaperCut API activity with authentication events to spot privilege escalation attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.