Executive brief
eScriptorium is a web application for transcribing and analyzing historical documents and manuscripts. A flaw in several API endpoints allows authenticated users to access, modify, and delete other users' transcription work by exploiting how the application retrieves data, potentially exposing sensitive research content and disrupting collaborative projects.
Technical details
An authorization bypass vulnerability exists in the Line, LineTranscription, VirtualCollection, tag, and process API endpoints. The root cause is that the application queries against a global model manager instead of enforcing request-scoped querysets, allowing authenticated attackers to specify arbitrary primary keys in request bodies to access records outside their authorization scope. The vulnerability requires network access and valid authentication credentials. An attacker can read, modify, and delete transcription content belonging to other users. The issue affects eScriptorium through version 26.04.1.
Affected products
- Scripta eScriptorium through 26.04.1
Timeline
- 2026-08-06: disclosed