CVE-2024-1222 is a high severity improper access control flaw in PaperCut NG and MF, rated 8.6. A maliciously formed API request can reach a higher authorization level on a small set of API calls. PaperCut's March 2024 bulletin says release 23.0.7 fixes it, so upgrade.
What's affected
The record describes a small subset of PaperCut NG/MF API calls where a crafted request gains an elevated API authorization level. NVD scores it 8.6 with network access and no privileges.
PaperCut's March 2024 security bulletin, last updated 14 March 2024, introduces 23.0.7 as the security focused release that fixes this and several other issues. It describes the problem as improper access controls on APIs, tracked by the researchers as ZDI-CAN-22812, and says it could allow privilege escalation on PaperCut NG/MF servers.
The bulletin also says PaperCut already pushed a mitigation through auto-update of sub-components if auto-update is enabled. That helps, but the bulletin still recommends upgrading. The bulletin text I read did not list a precise lowest affected version, so treat anything older than 23.0.7 as needing the upgrade.
Weakness class: CWE-250. The NVD record carries the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L and a score of 8.6.
How to check if you're exposed
Sign in to the PaperCut NG/MF admin interface, open the About tab and read the version under Version info. Anything below 23.0.7 should be upgraded.
The bulletin's own upgrade path is the over-the-top update. On the About tab click Check for updates, download the latest update and install it over your existing installation.
Check which servers are reachable from the internet or from untrusted networks. The bulletin says those, and environments with untrusted actors on the network such as a large university, should prioritise the upgrade.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan for the libraries in your own projects, and reachability analysis helps you tell which findings your code actually calls.
What to do now
- Record the current version on the About tab of each PaperCut NG/MF server.
- Run the over-the-top update to 23.0.7 or later and confirm the new version under Version info.
- Confirm auto-update of sub-components is enabled, since PaperCut used it for an interim mitigation.
- Restrict access to the application server so only expected clients, print devices and admins can reach it.
- Read the full March 2024 bulletin for the other CVEs fixed in the same release, since you are patching anyway.
Why it matters
The class is CWE-250, execution with unnecessary privileges. In practice the bulletin describes a misconfigured API endpoint where a crafted call receives a more privileged authorization level than it should.
Print management servers sit on internal networks with access to user directories and printers, so privilege escalation there has value to an attacker. The record's KEV flag is false for this CVE and the bulletin I read did not report exploitation of it. The NVD record's product list also includes macOS, which the bulletin text I read did not discuss, so verify your own platform against PaperCut's notes.
Quick check
Which PaperCut release fixes CVE-2024-1222?
The March 2024 bulletin names 23.0.7 as the release that fixes the issues it lists, including this one.
Is auto-update enough?
The bulletin says a mitigation was pushed through auto-update where enabled, but it still recommends planning the upgrade.
Sources
Last reviewed: 19 October 2026.
