CVE-2026-18258 PUBLISHED

Authorization Bypass Through User-Controlled Key in eScriptorium

Assigner: GitLab
Reserved: 29.07.2026 Published: 06.08.2026 Updated: 06.08.2026

Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process API endpoints in Scripta/eScriptorium through 26.04.1 allows a remote authenticated user to read, modify and delete other users' transcription content via primary keys supplied in the request body, which are queried against the global model manager instead of the request-scoped queryset

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.8

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	Scripta
Product	eScriptorium
Versions	Default: unaffected affected from 0 to 26.4.1 (incl.)

Solutions

Upgrade to fixed version: 26.04.2, 1.0.1 or 0.13.9.

Credits

Thibault Clérice & Hassen Aguili finder

References

https://gitlab.com/scripta/escriptorium/-/work_items/1226

Problem Types

CWE-639: Authorization Bypass Through User-Controlled Key CWE