CVE-2026-125373

IETF Datatracker before 12.83.0 contains an authorization bypass vulnerability that allows NomCom role holders to access other committees' records by supplying sequential primary keys. Attackers can abuse view feedback nominee, view feedback topic, view feedback unrelated and edit nominee to view confidential nominee identities, reclassify feedback, and change nominee email addresses.