What’s Vulnerable › Vulnerabilities
CVE-2026-18258: Authorization Bypass Through User-Controlled Key in eScriptorium
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-06 · updated 2026-10-23
- Weakness: CWE-639
Description
Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process API endpoints in Scripta/eScriptorium through 26.04.1 allows a remote authenticated user to read, modify and delete other users' transcription content via primary keys supplied in the request body, which are queried against the global model manager instead of the request-scoped queryset
Affected products
- Scripta eScriptorium: through 26.04.1
References
Get alerted when CVE-2026-18258 or the next vulnerability affects your stack