CVE-2026-18276 in eScriptorium
Summary
by MITRE • 08/06/2026
Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event stream and observe another user's segmentation, transcription, import, export and training activity via the object_cls and object_pk values of a join-room message, which are passed to group_add without an access check
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/06/2026
This vulnerability exists in Scripta eScriptorium version 26.04.1 and earlier, representing a critical authorization flaw that undermines the system's security model. The issue stems from insufficient access controls within the websocket consumer implementation, specifically in how document-level events are managed and distributed to connected clients. A remote authenticated attacker can exploit this weakness by manipulating the join-room message parameters to subscribe to event streams belonging to documents they should not have access to, effectively enabling unauthorized surveillance of other users' activities.
The technical flaw manifests through improper validation of user permissions when processing websocket messages containing object_cls and object_pk values. These parameters identify specific document objects within the system's event stream architecture, yet the group_add function fails to verify whether the authenticated user possesses appropriate authorization rights to access the targeted document. This oversight creates a direct pathway for privilege escalation through unauthorized data observation, where attackers can monitor segmentation, transcription, import, export, and training activities occurring on documents they do not own or have explicit permission to view.
The operational impact of this vulnerability extends beyond simple information disclosure, as it enables comprehensive surveillance of user activities within the collaborative document processing environment. Attackers can gain insights into other users' work patterns, identify sensitive content being processed, and potentially infer confidential information through the observation of training data usage and segmentation workflows. This capability undermines the fundamental security assumptions of document isolation and user privacy that collaborative platforms rely upon for maintaining trust among users.
The vulnerability aligns with CWE-862 which addresses insufficient authorization checks, and represents a clear violation of the principle of least privilege in system design. From an ATT&CK perspective, this flaw maps to T1074 Data Staged and T1566 Impersonation techniques, as it enables attackers to collect and observe sensitive data without proper credentials or authorization. The attack vector specifically leverages the websocket communication channel to maintain persistent access to unauthorized event streams, making detection more challenging. Organizations should implement immediate access control checks within their websocket message processing pipelines, ensure proper authentication validation before group membership assignment, and consider implementing additional monitoring for unusual subscription patterns that may indicate exploitation attempts.
Mitigation strategies include enforcing strict authorization checks on all websocket message parameters, particularly those identifying document objects, implementing comprehensive logging of websocket subscription activities, and deploying network-level controls to monitor for anomalous access patterns. The system should validate user permissions against each object_cls and object_pk combination before executing group_add operations, ensuring that only authorized users can subscribe to specific document event streams. Regular security audits of websocket implementations should be conducted to identify similar authorization gaps, while also considering rate limiting and anomaly detection mechanisms to prevent automated exploitation attempts.