Georitm
Monthly
Unauthenticated remote attackers can disclose object-group data from ООО НПО Ритм GEOritm deployments up to version 2.45.1 because the /restapi/objects/obj-groups REST API endpoint fails to enforce authentication when handling the objectId argument (CWE-306). Publicly available exploit code exists, but the impact is bounded to low-confidentiality information disclosure with no integrity or availability effect; the vendor has released version 2.46 and patched the hosted geo.ritm.ru service. The vulnerability was also registered with FSTEC Russia as BDU:2026-11235.
Unauthenticated remote attackers can disclose object-group data from ООО НПО Ритм GEOritm deployments up to version 2.45.1 because the /restapi/objects/obj-groups REST API endpoint fails to enforce authentication when handling the objectId argument (CWE-306). Publicly available exploit code exists, but the impact is bounded to low-confidentiality information disclosure with no integrity or availability effect; the vendor has released version 2.46 and patched the hosted geo.ritm.ru service. The vulnerability was also registered with FSTEC Russia as BDU:2026-11235.