HIGH
CVE-2026-18277
CVSS
7.1
Description
Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to grant themselves access to another user's private OCR model and to revoke any user's OCR model access via a POST request, because the ownership check is placed in get_context_data() and therefore runs only on the GET rendering path
Weakness (CWE)
CWE-862
Missing Authorization
EPSS Score
0.24%
Probability of exploitation in next 30 days
15th percentile
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.