Description

Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process API endpoints in Scripta/eScriptorium through 26.04.1 allows a remote authenticated user to read, modify and delete other users' transcription content via primary keys supplied in the request body, which are queried against the global model manager instead of the request-scoped queryset

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-06T16:16:37.727Z",
  "pubdate": "2026-08-06T16:16:37.727Z",
  "executiveSummary": "An authorization bypass vulnerability has been identified in Scripta/eScriptorium through version 26.04.1.\nThe vulnerability affects multiple API endpoints including Line, LineTranscription, VirtualCollection, tag, and process.\nThe flaw permits a remote authenticated user to read, modify, and delete transcription content belonging to other users.\nThis unauthorized data manipulation occurs due to improper object reference handling where primary keys supplied in the request body are queried against the global model manager rather than a request-scoped queryset.\nThe risk implication is a complete loss of confidentiality, integrity, and availability for user-generated transcription data within the application.\nExploitation requires the attacker to be authenticated within the system and capable of sending crafted HTTP requests containing arbitrary primary keys to the vulnerable API endpoints.",
  "technicalDetails": "The root cause of this vulnerability lies in the lack of proper object-level authorization checks combined with insecure querying practices within the application's API views.\nSpecifically, when interacting with the Line, LineTranscription, VirtualCollection, tag, and process API endpoints, the application processes primary keys supplied directly within the request body.\nInstead of restricting database queries to a request-scoped queryset that verifies ownership or permissions tied to the currently authenticated user, the backend queries the global model manager directly.\nThis bypasses tenancy and access control boundaries, allowing any authenticated user to supply the primary key of a resource belonging to another user.\nThe attack flow begins with an authenticated attacker identifying or enumerating valid primary keys associated with targeted transcription content, lines, collections, tags, or processes.\nThe attacker then crafts an HTTP request targeting one of the vulnerable API endpoints, injecting the foreign primary keys into the request body.\nUpon receiving the request, the application executes queries against the global model manager using the supplied primary keys without validating whether the authenticated user possesses the requisite authorization to access the referenced objects.\nConsequently, the backend processes the request, granting the attacker the ability to read sensitive transcription data, modify existing records, or execute deletion operations against other users' assets.\nThe affected components are the API endpoints handling Line, LineTranscription, VirtualCollection, tag, and process resources in Scripta/eScriptorium through version 26.04.1."
}