PatchTheCVECVE-2026-18275: Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium through 26.04.
31
Routine
MEDIUM 6.5UPGRADE
CVE-2026-18275 is a medium-severity flaw (CVSS 6.5) affecting escriptorium. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to run segmentation and transcription against other users' document parts, overwriting their content, via part primary keys supplied to a many=True related field whose queryset restriction was applied to the ManyRelatedField instead of its child_relation and therefore had no effect
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.5 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 68%) |
| CISA exploited list | No |
| Weakness | CWE-639 |
| Published | 2026-08-06 |
| Last modified | 2026-10-23 |
Publisher (CNA): GitLab Inc. · Vendor: escriptorium
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
escriptorium escriptorium UPGRADE
Affected: <= 26.04.1
Fixed in: newer than 26.04.1
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy escriptorium || rpm -q escriptorium || escriptorium --version
2. UPGRADE to newer than 26.04.1 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade escriptorium
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade escriptorium
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Related CVEs
- CVE-2026-18258 HIGH 8.8 UPGRADE Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process API endpoints in Scrip
- CVE-2026-18359 HIGH 8.5 UPGRADE Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 a
- CVE-2026-18277 HIGH 7.1 UPGRADE Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 all
- CVE-2026-18276 MEDIUM 4.3 UPGRADE Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authen