CVE-2026-100177

Name of the Vulnerable Software and Affected Versions AIL Framework (affected versions not specified)

Description The crawler task creation API 'api add crawler task' contains an insufficient authorization check when a user provides a cookiejar UUID for a one-shot or scheduled crawler task. The system fails to validate organizational boundaries or the requesting user's role. Specifically, if the cookiejar access level is not 0, no access check is performed; if it is 0, the system only compares the owning user ID to the requesting user ID. An authenticated user with the ability to create crawler tasks who knows or guesses a valid cookiejar UUID from another organization can force the crawler to use that organization's stored cookies, such as session tokens and authentication credentials, leading to the exfiltration of session data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.