CVE-2026-18258: Authorization Bypass Through User-Controlled Key in eScriptorium
Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process API endpoints in Scripta/eScriptorium through 26.04.1 allows a remote authenticated user to read, modify and delete other users' transcription content via primary keys supplied in the request body, which are queried against the global model manager instead of the request-scoped queryset
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.04.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.0.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.13.9
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18258?
The severity of CVE-2026-18258 is rated as high, with a score of 8.8.
How do I fix CVE-2026-18258?
To fix CVE-2026-18258, apply the latest updates to eScriptorium that address the authorization bypass vulnerability.
What vulnerabilities are impacted by CVE-2026-18258?
CVE-2026-18258 affects the Line, LineTranscription, VirtualCollection, tag and process API endpoints in eScriptorium.
Who is affected by CVE-2026-18258?
Remote authenticated users of eScriptorium can be affected by CVE-2026-18258 as it allows unauthorized access to others' transcription content.
What actions can an attacker perform with CVE-2026-18258?
An attacker exploiting CVE-2026-18258 can read, modify, and delete other users' transcription content by using manipulated primary keys.