← Back

CVE-2026-18258

nvd nist
Published: Aug 6, 2026Modified: Aug 18, 2026

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: cve@gitlab.com (Secondary)

Description

Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process API endpoints in Scripta/eScriptorium through 26.04.1 allows a remote authenticated user to read, modify and delete other users' transcription content via primary keys supplied in the request body, which are queried against the global model manager instead of the request-scoped queryset

Affected (1)

Escriptorium
1 product
Escriptorium
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Escriptorium
Up to 26.04.1

Related CWEs

CWE-639
Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (1)

Source: cve@gitlab.com
Permissions Required

Timeline

No history available yet.