CVE-2026-18277: Missing Authorization in eScriptorium
Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to grant themselves access to another user's private OCR model and to revoke any user's OCR model access via a POST request, because the ownership check is placed in getcontextdata() and therefore runs only on the GET rendering path
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.04.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.0.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.13.9
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18277?
CVE-2026-18277 has a severity score of 7.1, classified as high.
How do I fix CVE-2026-18277?
To address CVE-2026-18277, ensure proper authorization checks are implemented in the OcrModelRight create and delete views.
What impact does CVE-2026-18277 have on users?
CVE-2026-18277 allows remote authenticated users to access and revoke private OCR models from other users.
Are there any known exploits for CVE-2026-18277?
Currently, there are no known public exploits specifically targeting CVE-2026-18277.
Which software is affected by CVE-2026-18277?
CVE-2026-18277 affects the eScriptorium version 26.04.1 of the Scripta eScriptorium software.