Description

Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to grant themselves access to another user's private OCR model and to revoke any user's OCR model access via a POST request, because the ownership check is placed in get_context_data() and therefore runs only on the GET rendering path

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-06T16:16:38.100Z",
  "pubdate": "2026-08-06T16:16:38.100Z",
  "executiveSummary": "A missing authorization vulnerability exists in the OcrModelRight create and delete views within Scripta eScriptorium through 26.04.1. This security defect allows a remote authenticated user to grant themselves unauthorized access to another user's private OCR model and to revoke any user's OCR model access. The flaw introduces severe risks to data confidentiality and integrity by enabling privilege misuse regarding sensitive machine learning assets. Exploitation requires the attacker to be authenticated within the application and involves issuing crafted POST requests to the vulnerable endpoints. Because the necessary ownership and permission validations are improperly enforced, unauthorized users can successfully manipulate access rights to private resources.",
  "technicalDetails": "The vulnerability stems from improper access control logic within the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1. Specifically, the ownership check and permission validation logic are placed exclusively inside the get_context_data() method of the class-based views. In Django-based or similar web frameworks, the get_context_data() method is executed solely during the GET request lifecycle for rendering view contexts and templates. It is typically bypassed entirely during POST requests, which handle data mutation operations such as creation and deletion.\nWhen a remote authenticated user sends a maliciously crafted POST request directly to the create or delete views for OcrModelRight, the application processes the state-changing action without executing the ownership check located in get_context_data(). Consequently, the authorization boundary is completely circumvented. An attacker with standard authenticated privileges can exploit this behavior to supply arbitrary model and user identifiers, thereby granting themselves unauthorized access permissions to private OCR models owned by other users or revoking legitimate users' access rights to their own models.\nThe affected components are the OcrModelRight create and delete views. The attack vector is network-based, requiring the attacker to possess a valid user account on the target instance of Scripta eScriptorium. No special elevated privileges are required prior to exploitation; standard user authentication is sufficient to interact with the endpoints. The post-exploitation impact includes unauthorized modification of access control lists, compromise of private OCR model confidentiality, and potential denial of service or disruption for legitimate users whose model access is abruptly revoked via malicious POST payloads."
}