Executive brief
eScriptorium is a document annotation and OCR management platform used by libraries and research institutions. A flaw in access control allows authenticated users to grant themselves access to other users' private OCR models or revoke access for any user. An attacker can exploit this through simple web requests to manipulate OCR model permissions without proper authorization checks.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the OcrModelRight create and delete views. The ownership validation is performed only in get_context_data(), which executes on GET requests for page rendering but is bypassed on POST requests that perform the actual modifications. This allows an authenticated attacker to POST directly to these endpoints and grant themselves access to private OCR models owned by other users or revoke any user's OCR model access. No additional preconditions beyond authentication are required. The fix requires moving the authorization check to apply to all HTTP methods, not just GET.
Affected products
- Scripta eScriptorium through 26.04.1
Timeline
- 2026-08-06: disclosed
- other: CVE-2026-18277 assigned