CVE-2026-18277: Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to grant themselves access to another
Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to grant themselves access to another user's private OCR model and to revoke any user's OCR model access via a POST request, because the ownership check is placed in get_context_data() and therefore runs only on the GET rendering path
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-18277
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-18277 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for Missing authorization in
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- criticalCVE-2026-65667: Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges…nvd · 2026-08-07
- criticalCVE-2026-62830: Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges o…nvd · 2026-08-07
- highCVE-2026-67621: Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated…nvd · 2026-08-06
- mediumGHSA-rvmm-v933-jgxq: Craft CMS: Missing authorization check allows non-admin control panel users access to use…ghsa · 2026-08-06
- mediumGHSA-9p7c-v5x3-rfx8: Craft CMS: Missing authorization check allows non-admin control panel users to reorder Gl…ghsa · 2026-08-06
- mediumGHSA-qh8c-7588-qfrv: Statamic: Missing authorization on navigation endpoint allows disclosure of restricted en…ghsa · 2026-08-06
More from NVD Recent CVEs
- criticalCVE-2026-70332: Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an unauthorized attac…2026-08-07
- criticalCVE-2026-68823: Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacke…2026-08-07
- highCVE-2026-65668: Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to eleva…2026-08-07
- criticalCVE-2026-65667: Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges…2026-08-07
- criticalCVE-2026-63508: Missing authentication for critical function in Microsoft Planetary Computer Pro allows an una…2026-08-07