CVE-2026-18275

Katalog CVE

CVSS 6.5 · Medium EPSS 0,39%

Kerentanan Authorization Bypass Through User-Controlled Key pada escriptorium. Skor CVSS 3.1 6.5 (Medium) menurut gitlab.com.

Deskripsi (NVD)

Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to run segmentation and transcription against other users' document parts, overwriting their content, via part primary keys supplied to a many=True related field whose queryset restriction was applied to the ManyRelatedField instead of its child_relation and therefore had no effect

Rincian

Terbit di NVD

6 Agustus 2026

Terakhir diubah

18 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber gitlab.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 31,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gitlab.com/scripta/escriptorium/-/work_items/1228 issue tracking