CVE-2026-100903 in GEOritm
Summary
by MITRE • 09/28/2026
A vulnerability was identified in ООО НПО Ритм GEOritm up to 2.45.1. This affects an unknown part of the file /restapi/objects/obj-groups of the component REST API. Such manipulation of the argument objectId leads to missing authentication. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 2.46 is able to mitigate this issue. It is advisable to upgrade the affected component. The vendor confirms: "In August 2026, NPO Ritm received an official vulnerability notification from the Russian Federal Service for Technical and Export Control (FSTEC Russia). The vulnerability was registered under identifier BDU:2026-11235. Following our internal investigation, we confirmed the vulnerability and implemented the necessary security fixes. The vulnerability has been fixed on our hosted GEO.RITM server at geo.ritm.ru. The fix has also been included in GEO.RITM version 2.46, which is already being distributed to our customers."
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/28/2026
The identified vulnerability affects the REST API component of ООО НПО Ритм GEOritm software, specifically within versions up to and including 2.45.1. The flaw resides in the handling of the objectId argument associated with the /restapi/objects/obj-groups endpoint. This specific implementation error results in a critical authentication bypass, allowing unauthorized actors to access sensitive data or perform administrative actions without valid credentials. As this is an API-based vulnerability accessible over network protocols, it can be exploited remotely by attackers who do not require prior local system access. The presence of publicly available exploits significantly elevates the risk profile, as malicious entities can leverage existing tooling to target vulnerable instances with minimal effort and technical sophistication.
From a technical perspective, this issue aligns closely with CWE-287, which describes Improper Authentication, and more specifically CWE-306, Missing Authentication for Critical Function. The root cause likely involves insufficient validation of the objectId parameter before enforcing access control checks on the server side. When an attacker manipulates this argument, the application fails to verify whether the requesting user has legitimate permissions associated with that specific object group. This breakdown in security logic allows direct interaction with protected resources, effectively rendering authentication mechanisms obsolete for those endpoints. Such flaws are frequently categorized under MITRE ATT&CK technique T1078, Valid Accounts, as attackers may use stolen or default credentials to gain initial access and then exploit this flaw to escalate privileges or exfiltrate data without triggering standard security alerts associated with brute-force attacks.
The operational impact of this vulnerability is severe for organizations relying on GEOritm for geographic information system management or related spatial data operations. Unauthorized access could lead to the disclosure of proprietary geospatial data, modification of critical configuration settings, or complete compromise of the underlying infrastructure if combined with other vulnerabilities. Given that the exploit code is publicly available, automated scanning tools and threat actors are likely actively probing internet-facing instances for this specific weakness. The vendor has confirmed receipt of an official vulnerability notification from the Russian Federal Service for Technical and Export Control (FSTEC Russia), registered under identifier BDU:2026-11235. This external validation underscores the severity and regulatory importance of addressing the issue promptly to maintain compliance with regional security standards.
To mitigate this risk, immediate action is required by system administrators and IT security teams responsible for maintaining GEOritm environments. The vendor has confirmed that a comprehensive fix was implemented in version 2.46 of the software. This update addresses the authentication bypass flaw within the REST API component, ensuring proper validation of user permissions before processing requests to the /restapi/objects/obj-groups endpoint. Organizations running versions up to 2.45.1 should prioritize upgrading to version 2.46 or later as soon as possible. For those utilizing hosted solutions at geo.ritm.ru, the vendor has already deployed these security fixes on their servers. It is also advisable to review access logs for any signs of exploitation prior to patching and to implement network-level controls such as Web Application Firewalls (WAF) rules that can detect and block anomalous requests targeting this specific API endpoint while migration efforts are underway.