Description

Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event stream and observe another user's segmentation, transcription, import, export and training activity via the object_cls and object_pk values of a join-room message, which are passed to group_add without an access check

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-06T16:16:37.977Z",
  "pubdate": "2026-08-06T16:16:37.977Z",
  "executiveSummary": "A missing authorization vulnerability exists in the websocket consumer of Scripta eScriptorium through versions 26.04.1. This flaw allows a remote authenticated user to bypass access controls and subscribe to arbitrary document event streams. By manipulating the object_cls and object_pk values within a join-room message, an attacker can observe another user's sensitive activities, including segmentation, transcription, import, export, and training operations. The root cause stems from passing user-supplied object identifiers directly to the group_add function without performing any validation to verify whether the authenticated user possesses permissions to access the specified resource. The impact includes unauthorized information disclosure of proprietary and confidential document processing workflows across different users on the platform. Exploitation requires the attacker to have a valid authenticated session on the target system to establish a WebSocket connection. No specific privilege levels beyond standard authentication are mentioned as prerequisites for this attack vector.",
  "technicalDetails": "The vulnerability resides within the WebSocket consumer component of Scripta eScriptorium through version 26.04.1, specifically in how incoming WebSocket messages are processed and routed to communication groups. The core architectural flaw is an absolute lack of authorization checks when processing join-room messages.\nDuring a standard WebSocket session initialization, the client sends a message requesting to join a specific communication room or channel. In the vulnerable implementation, this message payload contains parameters identified as object_cls and object_pk, which define the target object class and primary key for the event stream.\nThe application directly passes these unvalidated object_cls and object_pk values into the group_add function. Because the backend fails to validate authorization or ownership—specifically failing to check if the authenticated session token holder has explicit permissions to view the requested document or resource—any connected client can supply arbitrary identifiers.\nThe step-by-step attack flow proceeds as follows: First, a remote authenticated attacker establishes a standard WebSocket connection to the vulnerable eScriptorium endpoint. Second, the attacker crafts a join-room message payload containing target object_cls and object_pk values corresponding to a victim user's private document or workspace. Third, the WebSocket consumer processes the message and executes group_add using the attacker-supplied parameters without verifying access rights. Fourth, the attacker is successfully subscribed to the target event stream.\nOnce the subscription is established, the attacker receives real-time updates regarding another user's private interactions with the platform. This post-exploitation exposure grants the attacker visibility into sensitive operations such as text transcription progress, document segmentation boundaries, data import and export statuses, and machine learning model training activities. The network exposure is constrained only by the requirement of a valid authenticated connection to the WebSocket service, allowing any low-privileged or standard user to escalate their observational scope horizontally across the platform."
}