CVE-2026-18276

Name of the Vulnerable Software and Affected Versions Scripta eScriptorium versions prior to 26.04.2

Description Missing authorization in the websocket consumer allows a remote authenticated user to subscribe to the event stream of any document. This occurs because the object cls and object pk values of a join-room message are passed to the group add() function without an access check, enabling the observer to monitor another user's segmentation, transcription, import, export, and training activity.

Recommendations Update Scripta eScriptorium to version 26.04.2 or later.