CVE-2026-18276 Missing Authorization in eScriptorium

Medium 4.3 Published 6 Aug 2026 Updated 6 Aug 2026

Authenticated users can subscribe to any document's event stream to observe other users' activities due to missing authorization checks in the websocket consumer.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-18276?

CVE-2026-18276 is a medium-severity missing authorization vulnerability in Scripta eScriptorium, published on 6 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event stream and observe another user's segmentation, transcription, import, export and training activity via the object_cls and object_pk values of a join-room message, which are passed to group_add without an access check

Weakness: CWE-862

Which versions are affected by CVE-2026-18276?

It affects 1 product.

Products include Escriptorium Escriptorium.

How do I fix CVE-2026-18276?

No fix has been published for CVE-2026-18276 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-18276 being exploited?

There is no known exploitation of CVE-2026-18276 in the wild and no public exploit code.

Sources

Also known as GHSA-vr95-3w53-6w94.