EUVD-2026-54089
GHSA-vr95-3w53-6w94
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Requires valid account (PR:L); only real-time activity metadata disclosed, not document content (C:L); no integrity or availability impact applies.
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
Lifecycle Timeline
1DescriptionCVE.org
Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event stream and observe another user's segmentation, transcription, import, export and training activity via the object_cls and object_pk values of a join-room message, which are passed to group_add without an access check
AnalysisAI
Missing authorization in eScriptorium's WebSocket consumer (all versions through 26.04.1) allows any authenticated user to subscribe to arbitrary document event streams without access verification. By supplying a target document's object_cls and object_pk in a join-room WebSocket message, an attacker's connection is added to that document's channel group via group_add with no permission check, exposing real-time segmentation, transcription, import, export, and AI training activity belonging to other users. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS data was not provided in the available intelligence.
Technical ContextAI
eScriptorium is a Django-based web platform for OCR and collaborative historical document transcription, using Django Channels for real-time WebSocket event streaming. The vulnerable code path is the WebSocket consumer's join-room message handler, which accepts client-supplied object_cls and object_pk parameters to construct a named channel group and calls Django Channels' group_add to subscribe the requesting connection - without first checking whether the authenticated user has read permission on the referenced document object. CWE-862 (Missing Authorization) is the root cause class: the authorization enforcement point is simply absent from this code path. The affected CPE is cpe:2.3:a:scripta:escriptorium:*:*:*:*:*:*:*:* covering all versions through 26.04.1 per the EUVD affected range.
RemediationAI
The root fix requires adding a document-level authorization check in the WebSocket consumer's join-room handler to verify that the authenticated user holds read permission on the object identified by object_cls and object_pk before the group_add call is executed. Monitor the upstream GitLab work item at https://gitlab.com/scripta/escriptorium/-/work_items/1229 for a patched release; no confirmed fixed version is available at time of analysis. As an interim compensating control, administrators should restrict eScriptorium account creation to explicitly trusted collaborators, since exploitation requires any valid login - removing untrusted authenticated accounts eliminates the attacker population. Deployments that do not require external access can additionally restrict WebSocket endpoint reachability to internal networks or VPN, which reduces exposure without affecting functionality for legitimate users. No patch version number has been confirmed from the available data.
More in Escriptorium
View allAuthorization bypass across multiple API endpoints in eScriptorium through version 26.04.1 allows any authenticated user
Server-side request forgery in eScriptorium through 26.04.1 allows remote authenticated users to pivot from the applicat
Missing authorization in eScriptorium through version 26.04.1 allows any authenticated remote user to hijack access righ
Authorization bypass in eScriptorium through version 26.04.1 enables any authenticated remote user to overwrite other us
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today