CVE-2026-100903: ООО НПО Ритм GEOritm REST API obj-groups missing authentication
A vulnerability was identified in ООО НПО Ритм GEOritm up to 2.45.1. This affects an unknown part of the file /restapi/objects/obj-groups of the component REST API. Such manipulation of the argument objectId leads to missing authentication. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 2.46 is able to mitigate this issue. It is advisable to upgrade the affected component. The vendor confirms: "In August 2026, NPO Ritm received an official vulnerability notification from the Russian Federal Service for Technical and Export Control (FSTEC Russia). The vulnerability was registered under identifier BDU:2026-11235. Following our internal investigation, we confirmed the vulnerability and implemented the necessary security fixes. The vulnerability has been fixed on our hosted GEO.RITM server at geo.ritm.ru. The fix has also been included in GEO.RITM version 2.46, which is already being distributed to our customers."
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ООО НПО Ритм GEO.RITM REST APIto a version that resolves this vulnerability.Fixed in 2.46
Event History
Frequently Asked Questions
Which deployments should be prioritized for remediation?
GEOritm installations up to version 2.45.1 should be prioritized, particularly any instance with the REST API reachable remotely. The vendor states that the fix is included in GEO.RITM 2.46 and has been applied to its hosted geo.ritm.ru server.
What does an attacker need to exploit this issue?
An attacker can launch the attack remotely and does not need authentication. Exploitation involves manipulating the objectId argument for the /restapi/objects/obj-groups REST API endpoint, and a public exploit is available.
What should teams do if they cannot upgrade immediately?
The provided information identifies upgrading to version 2.46 as the mitigation. No alternative workaround is specified, so teams should limit remote exposure to the affected REST API endpoint until they can upgrade.