EUVD-2026-88070
GHSA-g456-7977-c699
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed GEOritm REST API
-
ExploitSend request to /restapi/objects/obj-groups
-
ExecutionManipulate objectId to bypass missing auth
-
ImpactRead unauthorized object-group data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reachability to the GEOritm REST API endpoint /restapi/objects/obj-groups on an instance running version 2.45.1 or earlier. No authentication, no user interaction, and no special configuration are needed (CWE-306 missing authentication; PR:N/UI:N/AC:L) - the endpoint fails to enforce auth on the objectId argument by default. Limiting factors: the API must be network-exposed to the attacker, and only object-group data is disclosed (no write or availability impact); customers who have upgraded to 2.46, or who use the already-patched hosted geo.ritm.ru service, are not affected. |
| Impact | This is a genuine but bounded issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation with no user interaction - a straightforward attack profile. However, impact is limited to confidentiality only (VC:L, with VI:N/VA:N), meaning this is an information-disclosure flaw exposing object-group data, not a path to code execution, data modification, or denial of service. Exploitation signals are mixed but coherent: publicly available exploit code exists (pastebin) and the CVSS carries E:P (Proof-of-Concept exploit maturity), but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation. The vendor and FSTEC Russia (BDU:2026-11235) have both confirmed the vulnerability, which raises confidence that the flaw is real. Net assessment: real and easily exploitable, but modest impact and a niche, primarily-Russian-market product keep real-world priority low-to-moderate. This is not a high-CVSS-but-fake issue - the 6.9 base is honest - but the confidentiality-only scope means it is not a critical-priority event for most global organizations. |
| Exploit ScenarioDerived | A remote attacker with no credentials sends a crafted request to the /restapi/objects/obj-groups REST API endpoint, manipulating the objectId parameter to retrieve object-group data that should require authentication. Publicly available proof-of-concept exploit code (pastebin) lowers the barrier, and the low attack complexity (AC:L) means no special timing or conditions are needed against affected GEOritm instances (up to 2.45.1). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
Unauthenticated remote attackers can disclose object-group data from ООО НПО Ритм GEOritm deployments up to version 2.45.1 because the /restapi/objects/obj-groups REST API endpoint fails to enforce authentication when handling the objectId argument (CWE-306). Publicly available exploit code exists, but the impact is bounded to low-confidentiality information disclosure with no integrity or availability effect; the vendor has released version 2.46 and patched the hosted geo.ritm.ru service. The vulnerability was also registered with FSTEC Russia as BDU:2026-11235.
RemediationAI
Upgrade to GEOritm version 2.46, which includes the vendor-released patch for CVE-2026-100903; customers using the hosted geo.ritm.ru service are already protected. If immediate upgrade is not possible, restrict network access to the GEOritm REST API endpoint /restapi/objects/obj-groups so that only trusted networks or authenticated reverse proxies can reach it, or block external requests to that path at the perimeter firewall; this may disrupt legitimate clients that rely on the endpoint and should be tested before deployment. Additional compensating controls include monitoring for unauthenticated requests to /restapi/objects/obj-groups and applying IP allow-listing. For patch details or support, contact the vendor via https://ritm.ru/contacts/.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an instance of CWE-306 Missing Authentication for Critical Function. The GEOritm REST API exposes an endpoint /restapi/objects/obj-groups that is intended to return information about object groups; however, it does not validate authentication for requests that specify an objectId. The affected component is the REST API of the GEOritm product from ООО НПО Ритм, identified by CPE cpe:2.3:a:ооо_нпо_ритм:georitm:*:*:*:*:*:*:*:*. Exploitation requires only network reachability to the endpoint - no credentials, user interaction, or special configuration (independent assessment CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Although the CVE record lists a CVSS 4.0 score of 6.9, the practical effect is limited to low-severity confidentiality loss (object-group data) with no write or availability impact. Public proof-of-concept code has been published on Pastebin, and the vendor confirmed the issue after notification from FSTEC Russia (BDU:2026-11235).
Know when Georitm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Remote unauthenticated low-complexity API access with no user interaction (AV:N/AC:L/PR:N/UI:N); missing-auth data read yields confidentiality-only impact (C:L), no integrity or availability effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was identified in ООО НПО Ритм GEOritm up to 2.45.1. This affects an unknown part of the file /restapi/objects/obj-groups of the component REST API. Such manipulation of the argument objectId leads to missing authentication. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 2.46 is able to mitigate this issue. It is advisable to upgrade the affected component. The vendor confirms: "In August 2026, NPO Ritm received an official vulnerability notification from the Russian Federal Service for Technical and Export Control (FSTEC Russia). The vulnerability was registered under identifier BDU:2026-11235. Following our internal investigation, we confirmed the vulnerability and implemented the necessary security fixes. The vulnerability has been fixed on our hosted GEO.RITM server at geo.ritm.ru. The fix has also been included in GEO.RITM version 2.46, which is already being distributed to our customers."
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB