Executive brief
eScriptorium is a web-based platform for document transcription and text recognition. An authenticated attacker can bypass authorization controls to run document processing (segmentation and transcription) on other users' documents, potentially overwriting their transcribed content and disrupting collaborative work.
Technical details
The vulnerability is an authorization bypass in the process and annotation taxonomy serializers, caused by queryset restrictions being applied to the ManyRelatedField instead of its child_relation, rendering the restrictions ineffective. An authenticated user can supply arbitrary part primary keys to many=True related fields, allowing them to run segmentation and transcription operations against document parts belonging to other users. This affects eScriptorium through version 26.04.1. The attack requires authentication and network access to the web application.
Affected products
- Scripta eScriptorium through 26.04.1
Timeline
- 2026-08-06: disclosed: CVE-2026-18275 published
- 2026-08-06: advisory