Executive brief
eScriptorium is a document transcription and analysis platform. A missing access control check in the websocket event system allows authenticated users to subscribe to any document's activity stream without permission, exposing other users' transcription work, training activities, and file operations to unauthorized observation.
Technical details
The vulnerability is an authorization bypass in the websocket consumer component. The vulnerable code accepts object_cls and object_pk parameters from a join-room message and adds the client to the corresponding event stream group via group_add without verifying the user has access to that document. An authenticated attacker can craft a websocket message with object identifiers of any document to subscribe to real-time event streams, observing segmentation, transcription, import, export, and training activities performed by legitimate users. The attack requires prior authentication but no other preconditions; the websocket endpoint is network-reachable.
Affected products
- Scripta eScriptorium through 26.04.1
Timeline
- 2026-08-06: disclosed