CVE-2026-18276: Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event stream and observe a
Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event stream and observe another user's segmentation, transcription, import, export and training activity via the object_cls and object_pk values of a join-room message, which are passed to group_add without an access check
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-18276
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-18276 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for Missing authorization in
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- criticalCVE-2026-65667: Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges…nvd · 2026-08-07
- criticalCVE-2026-62830: Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges o…nvd · 2026-08-07
- highCVE-2026-67621: Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated…nvd · 2026-08-06
- mediumGHSA-rvmm-v933-jgxq: Craft CMS: Missing authorization check allows non-admin control panel users access to use…ghsa · 2026-08-06
- mediumGHSA-9p7c-v5x3-rfx8: Craft CMS: Missing authorization check allows non-admin control panel users to reorder Gl…ghsa · 2026-08-06
- mediumGHSA-qh8c-7588-qfrv: Statamic: Missing authorization on navigation endpoint allows disclosure of restricted en…ghsa · 2026-08-06
More from NVD Recent CVEs
- criticalCVE-2026-70332: Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an unauthorized attac…2026-08-07
- criticalCVE-2026-68823: Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacke…2026-08-07
- highCVE-2026-65668: Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to eleva…2026-08-07
- criticalCVE-2026-65667: Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges…2026-08-07
- criticalCVE-2026-63508: Missing authentication for critical function in Microsoft Planetary Computer Pro allows an una…2026-08-07