CVE-2026-18276

MediumCVSS 4.3

Published: 06/08/2026(UTC)Updated: 23/10/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

28th percentile - higher than 28% of all known CVEs

Summary

Missing authorization in the WebSocket consumer in Scripta eScriptorium (through 26.04.1) allows a remote authenticated user to subscribe to any document's event stream and observe another user's segmentation, transcription, import, export and training activity via the object_cls and object_pk values of a join-room message, which are passed to group_add without an access check.

Risk Assessment

An authenticated user can gain insight into confidential data and activities of other users, violating privacy and potentially leading to information leakage. The lack of access control enables unauthorized viewing of documents.

Recommendation

It is recommended to immediately upgrade eScriptorium to a version newer than 26.04.1 if a fix is available. Also, add proper permission checks before adding a user to a WebSocket group.

Other vulnerabilities in eScriptorium

CVE-2026-18275Medium
Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium (through 26.04.1) allows a remote authenticated user to run segmentation and transcription against other users' document parts, overwriting their content, via part primary keys supplied to a many=True related field whose queryset restriction was applied to the ManyRelatedField instead of its child_relation and therefore had no effect.

Original NVD description (English source)

Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event stream and observe another user's segmentation, transcription, import, export and training activity via the object_cls and object_pk values of a join-room message, which are passed to group_add without an access check

Vulnerability data from NVD (NIST) · CISA KEV · EPSS