Improper access control in the PaperCut MF/NG web management interface lets unauthenticated remote requests to administrative functions trigger backend actions before access validation completes, enabling modification of certain system configurations. Affects versions prior to 24.1.10, 25.0.13, and 26.0.5. Upgrade to 24.1.10, 25.0.13, or 26.0.5 to mitigate.