CVE-2026-125373 IETF Datatracker before 12.83.0 Cross-NomCom Authorization Bypass via Nomcom Views

Medium 5.3 Published 9 Nov 2026 Updated 9 Nov 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-125373?

CVE-2026-125373 is a medium-severity vulnerability in ietf-tools datatracker, published on 9 Nov 2026.

Official description

IETF Datatracker before 12.83.0 contains an authorization bypass vulnerability that allows NomCom role holders to access other committees' records by supplying sequential primary keys. Attackers can abuse view_feedback_nominee, view_feedback_topic, view_feedback_unrelated and edit_nominee to view confidential nominee identities, reclassify feedback, and change nominee email addresses.

Weakness: CWE-639

Which versions are affected by CVE-2026-125373?

How do I fix CVE-2026-125373?

No fix has been published for CVE-2026-125373 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-125373 being exploited?

There is no known exploitation of CVE-2026-125373 in the wild and no public exploit code.

Sources

Also known as GHSA-767r-3gfx-x4wx.