PatchTheCVECVE-2026-18277: Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 all
33
Routine
HIGH 7.1UPGRADE
CVE-2026-18277 is a high-severity flaw (CVSS 7.1) affecting escriptorium. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to grant themselves access to another user's private OCR model and to revoke any user's OCR model access via a POST request, because the ownership check is placed in get_context_data() and therefore runs only on the GET rendering path
Why this priority
- High severity
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.1 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 66%) |
| CISA exploited list | No |
| Weakness | CWE-862 |
| Published | 2026-08-06 |
| Last modified | 2026-10-23 |
Publisher (CNA): GitLab Inc. · Vendor: escriptorium
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
escriptorium escriptorium UPGRADE
Affected: <= 26.04.1
Fixed in: newer than 26.04.1
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy escriptorium || rpm -q escriptorium || escriptorium --version
2. UPGRADE to newer than 26.04.1 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade escriptorium
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade escriptorium
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Related CVEs
- CVE-2026-18258 HIGH 8.8 UPGRADE Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process API endpoints in Scrip
- CVE-2026-18359 HIGH 8.5 UPGRADE Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 a
- CVE-2026-18275 MEDIUM 6.5 UPGRADE Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium through 26.04.
- CVE-2026-18276 MEDIUM 4.3 UPGRADE Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authen