CVE-2026-18258: escriptorium through 26.04.1 (inclusive); +1 more affected products

CVE-2026-18258. CVSS 3.1 base score 8.8 (HIGH, Vendor/CNA). EPSS 0.00528 (percentile 0.43872), scored 22-Oct-2026.

Affected technology

escriptorium · through 26.04.1 (inclusive)
escriptorium

eScriptorium · 0 through 26.4.1
Scripta

Description’s affected range: through 26.04.1

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

A remote authenticated user can read, modify and delete other users' transcription content via primary keys supplied in the request body, which are queried against the global model manager instead of the request-scoped queryset. Vendor/CNA’s CVSS 3.1 assessment (base score 8.8/10) rates confidentiality, integrity and availability impact as high.

Published 24-Oct-2026 01:43 UTC

CWE: CWE-639
CCR priority: 35.3 /100 (P4)
CVSS 3.1: 8.8 /10 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · Vendor/CNA
EPSS: 0.00528 · percentile 0.43872 · 2026-10-22
KEV: no

Provenance

NVD CVE API 2.0 · Source record · observed 2026-10-24 01:40:49.068977+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-18258.html