CyberRota Analysis
AI-GeneratedThe vulnerability allows remote authenticated users to manipulate access controls in the OcrModelRight create and delete views of Scripta eScriptorium, enabling them to gain unauthorized access to other users' private OCR models and revoke access to any user's models. This flaw arises from a missing authorization check that only executes during the GET request, leaving POST requests unprotected. Organizations using Scripta eScriptorium should prioritize this issue to prevent potential data breaches and unauthorized access to sensitive OCR models.
Original NVD Description
Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to grant themselves access to another user's private OCR model and to revoke any user's OCR model access via a POST request, because the ownership check is placed in get_context_data() and therefore runs only on the GET rendering path