v2.20.15

nazdridoy/kokoro-ttsv2.20.15Apr 27, 2026by github-actions[bot]

AI Summary

Addresses a security vulnerability (GHSA-8c6x-pfjq-9gr7) and includes fixes for login/logout endpoints, mail account enumeration scope, CustomFieldQueryAtom operator changes, and API notes endpoint validation.

Key Highlights

Addresses security issue GHSA-8c6x-pfjq-9gr7
Fix: use only allauth login/logout endpoints
Fix: correctly scope mail account enumeration
Fix: prevent intermediate change event when CustomFieldQueryAtom operator changes type
Fix: reject invalid requests to API notes endpoint

Full Release Notes

## paperless-ngx 2.20.15

> [!NOTE]
> This release addresses a security issue (GHSA-8c6x-pfjq-9gr7) and is recommended for all users. Our sincere thank you to the community members who reported this.

### Bug Fixes

- Fix: use only allauth login/logout endpoints @shamoon ([#12639](https://github.com/paperless-ngx/paperless-ngx/pull/12639))
- Fix: correctly scope mail account enumeration @shamoon ([#12636](https://github.com/paperless-ngx/paperless-ngx/pull/12636))
- Fix: prevent intermediate change event when CustomFieldQueryAtom operator changes type @ggouzi (#12597)
- Fix: reject invalid requests to API notes endpoint @ggouzi (#12582)

### All App Changes

<details>
<summary>4 changes</summary>

- Fix: use only allauth login/logout endpoints @shamoon ([#12639](https://github.com/paperless-ngx/paperless-ngx/pull/12639))
- Fix: correctly scope mail account enumeration @shamoon ([#12636](https://github.com/paperless-ngx/paperless-ngx/pull/12636))
- Fix: prevent intermediate change event when CustomFieldQueryAtom operator changes type (#12597)
- Fix: reject invalid requests to API notes endpoint (#12582)
</details>