CVE-2026-18258

Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process API endpoints in Scripta/eScriptorium through 26.04.1 allows a remote authenticated user to read, modify and delete other users' transcription content via primary keys supplied in the request body, which are queried against the global model manager instead of the request-scoped queryset

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://gitlab.com/scripta/escriptorium/-/work_items/1226	Permissions Required

Configurations

Configuration 1 (hide)

cpe:2.3:a:escriptorium:escriptorium:*:*:*:*:*:*:*:*

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Omisión de autorización en los endpoints de la API Line, LineTranscription, VirtualCollection, tag y process en Scripta/eScriptorium hasta la versión 26.04.1 permite a un usuario remoto autenticado leer, modificar y eliminar contenido de transcripción de otros usuarios a través de claves primarias suministradas en el cuerpo de la solicitud, las cuales son consultadas contra el gestor de modelos global en lugar del queryset con ámbito de solicitud.

Information

Published : 2026-08-06 16:16

Updated : 2026-10-23 21:10

NVD link : CVE-2026-18258

Mitre link : CVE-2026-18258

CVE.ORG link : CVE-2026-18258

JSON object : View

Products Affected

escriptorium

escriptorium

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-18258", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18258", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-06T15:45:38.837492Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@gitlab.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@gitlab.com", "affectedData": [{"vendor": "Scripta", "product": "eScriptorium", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "26.4.1"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-06T16:16:37.727", "references": [{"url": "https://gitlab.com/scripta/escriptorium/-/work_items/1226", "tags": ["Permissions Required"], "source": "cve@gitlab.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@gitlab.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process API endpoints in Scripta/eScriptorium through 26.04.1 allows a remote authenticated user to read, modify and delete other users' transcription content via primary keys supplied in the request body, which are queried against the global model manager instead of the request-scoped queryset"}, {"lang": "es", "value": "Omisi\u00f3n de autorizaci\u00f3n en los endpoints de la API Line, LineTranscription, VirtualCollection, tag y process en Scripta/eScriptorium hasta la versi\u00f3n 26.04.1 permite a un usuario remoto autenticado leer, modificar y eliminar contenido de transcripci\u00f3n de otros usuarios a trav\u00e9s de claves primarias suministradas en el cuerpo de la solicitud, las cuales son consultadas contra el gestor de modelos global en lugar del queryset con \u00e1mbito de solicitud."}], "lastModified": "2026-10-23T21:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:escriptorium:escriptorium:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "362E7B9E-A763-49D5-B9FE-9105E6759CCB", "versionEndIncluding": "26.04.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@gitlab.com"}