Description
Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process API endpoints in Scripta/eScriptorium through 26.04.1 allows a remote authenticated user to read, modify and delete other users- transcription content via primary keys supplied in the request body, which are queried against the global model manager instead of the request-scoped queryset
CVSS 8.8EPSS 0.31%Risk 0.9
View source- Published
- 2026-08-06 16:16:37
- Last modified
- 2026-08-06 22:16:49
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H