PatchSiren cyber security CVE debrief

CVE-2026-18277 Scripta CVE debrief

PatchSiren debrief for CVE-2026-18277 based on limited source detail. The CVE record was published on 2026-08-06T16:16:38.100Z and has not been modified since then. This CVE describes a vulnerability in Scripta eScriptorium through version 26.04.1, where missing authorization in the OcrModelRight create and delete views allows a remote authenticated user to grant themselves access to another user's private OCR model and to revoke any user's OCR model access via a POST request. The vulnerability arises because the ownership check is placed in get_context_data() and therefore runs only on the GET rendering path. Users of Scripta eScriptorium, especially those with remote authenticated access, should verify and restrict model permissions. Evidence is limited; verify affected scope and vendor remediation status. Perform inventory checks for Scripta eScriptorium version 26.04.1 and earlier. Verify and restrict model permissions. Perform inventory checks for affected Scripta eScriptorium versions. Monitor for suspicious OCR model access. This issue has a CVSS score of 7.1 and is considered HIGH severity.

Vendor: Scripta
Product: eScriptorium
CVSS: HIGH 7.1
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-08-06
Original CVE updated: 2026-08-06
Advisory published: 2026-08-06
Advisory updated: 2026-08-06

Who should care

Users of Scripta eScriptorium, especially those with remote authenticated access, should verify and restrict model permissions. Affected operator, platform, vulnerability-management, and security-team impact should be reviewed.

Technical summary

CVE-2026-18277: Missing authorization in OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to grant themselves access to another user's private OCR model and revoke any user's OCR model access. This occurs because the ownership check is only performed on the GET rendering path, not on POST requests. Users of Scripta eScriptorium, especially those with remote authenticated access, should verify and restrict model permissions. Affected operator, platform, vulnerability-management, and security-team impact should be reviewed. The vulnerability can be exploited by sending a POST request to the OcrModelRight create and delete views, allowing an attacker to manipulate OCR model access. The CVSS score for this vulnerability is 7.1, indicating a HIGH severity level.

Defensive priority

Authenticated users with limited privileges may be able to manipulate OCR model access; verify and restrict model permissions.

Recommended defensive actions

Verify and restrict OCR model permissions
Perform inventory checks for affected Scripta eScriptorium versions
Monitor for suspicious OCR model access
Review compensating controls for exposed systems while remediation is scheduled and verified
Check relevant monitoring, detection, and logs for exposed assets that need extra review
Track exceptions, retest remediated assets, and close the item only after evidence is documented
Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

PatchSiren debrief for CVE-2026-18277 based on limited source detail. The CVE record was published on 2026-08-06T16:16:38.100Z and has not been modified since then. Evidence is limited; verify affected scope and vendor remediation status. Perform inventory checks for Scripta eScriptorium version 26.04.1 and earlier. Verify and restrict model permissions. Perform inventory checks for affected Scripta eScriptorium versions. Monitor for suspicious OCR model access.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-06T16:16:38.100Z and has not been modified since then.