CVE-2026-18275

Name of the Vulnerable Software and Affected Versions Scripta eScriptorium versions prior to 26.04.2

Description An authorization bypass exists in the process and annotation taxonomy serializers. This flaw allows a remote authenticated user to perform segmentation and transcription on document parts belonging to other users, leading to the overwriting of their content. The issue occurs when part primary keys are supplied to a many=True related field where the queryset restriction was incorrectly applied to the ManyRelatedField instead of its child relation, rendering the restriction ineffective.

Recommendations Update Scripta eScriptorium to version 26.04.2 or later.